import "pe"
import "math"

rule Mimikatz_Memory_Rule_1 {
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 1"
   strings:
      $s1 = "sekurlsa::msv" fullword ascii
       $s2 = "sekurlsa::wdigest" fullword ascii
       $s4 = "sekurlsa::kerberos" fullword ascii
       $s5 = "sekurlsa::tspkg" fullword ascii
       $s6 = "sekurlsa::livessp" fullword ascii
       $s7 = "sekurlsa::ssp" fullword ascii
       $s8 = "sekurlsa::logonPasswords" fullword ascii
       $s9 = "sekurlsa::process" fullword ascii
       $s10 = "ekurlsa::minidump" fullword ascii
       $s11 = "sekurlsa::pth" fullword ascii
       $s12 = "sekurlsa::tickets" fullword ascii
       $s13 = "sekurlsa::ekeys" fullword ascii
       $s14 = "sekurlsa::dpapi" fullword ascii
       $s15 = "sekurlsa::credman" fullword ascii
   condition:
      1 of them
}

rule Mimikatz_Memory_Rule_2 {
   meta:
       description = "Detect the risk of Malware Mimikatz Rule 2"
   strings:
      $s0 = "sekurlsa::" ascii
      $x1 = "cryptprimitives.pdb" ascii
      $x2 = "Now is t1O" ascii fullword
      $x4 = "ALICE123" ascii
      $x5 = "BOBBY456" ascii
   condition:
      $s0 and 2 of ($x*)
}

rule mimikatz
{
   meta:
       description = "Detect the risk of Malware Mimikatz Rule 3"

   strings:
      $exe_x86_1      = { 89 71 04 89 [0-3] 30 8d 04 bd }
      $exe_x86_2      = { 8b 4d e? 8b 45 f4 89 75 e? 89 01 85 ff 74 }

      $exe_x64_1      = { 33 ff 4? 89 37 4? 8b f3 45 85 c? 74}
      $exe_x64_2      = { 4c 8b df 49 [0-3] c1 e3 04 48 [0-3] 8b cb 4c 03 [0-3] d8 }

      $sys_x86      = { a0 00 00 00 24 02 00 00 40 00 00 00 [0-4] b8 00 00 00 6c 02 00 00 40 00 00 00 }
      $sys_x64      = { 88 01 00 00 3c 04 00 00 40 00 00 00 [0-4] e8 02 00 00 f8 02 00 00 40 00 00 00 }

   condition:
      (all of ($exe_x86_*)) or (all of ($exe_x64_*))
      or (any of ($sys_*))
}

rule wce
{
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 4"
   strings:
      $hex_legacy      = { 8b ff 55 8b ec 6a 00 ff 75 0c ff 75 08 e8 [0-3] 5d c2 08 00 }
      $hex_x86      = { 8d 45 f0 50 8d 45 f8 50 8d 45 e8 50 6a 00 8d 45 fc 50 [0-8] 50 72 69 6d 61 72 79 00 }
      $hex_x64      = { ff f3 48 83 ec 30 48 8b d9 48 8d 15 [0-16] 50 72 69 6d 61 72 79 00 }
   condition:
      any of them
}

rule power_pe_injection
{
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 5"
   strings:
      $str_loadlib   = "0x53, 0x48, 0x89, 0xe3, 0x48, 0x83, 0xec, 0x20, 0x66, 0x83, 0xe4, 0xc0, 0x48, 0xb9"
   condition:
      $str_loadlib
}

rule Mimikatz_Logfile
{
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 6"
   strings:
      $s1 = "SID               :" ascii fullword
      $s2 = "* NTLM     :" ascii fullword
      $s3 = "Authentication Id :" ascii fullword
      $s4 = "wdigest :" ascii fullword
   condition:
      all of them
}

rule Mimikatz_Strings {
   meta:
       description = "Detect the risk of Malware Mimikatz Rule 7"
   strings:
      $x1 = "sekurlsa::logonpasswords" fullword wide ascii
      $x2 = "List tickets in MIT/Heimdall ccache" fullword ascii wide
      $x3 = "kuhl_m_kerberos_ptt_file ; LsaCallKerberosPackage %08x" fullword ascii wide
      $x4 = "* Injecting ticket :" fullword wide ascii
      $x5 = "mimidrv.sys" fullword wide ascii
      $x6 = "Lists LM & NTLM credentials" fullword wide ascii
      $x7 = "\\_ kerberos -" fullword wide ascii
      $x8 = "* unknow   :" fullword wide ascii
      $x9 = "\\_ *Password replace ->" fullword wide ascii
      $x10 = "KIWI_MSV1_0_PRIMARY_CREDENTIALS KO" ascii wide
      $x11 = "\\\\.\\mimidrv" wide ascii
      $x12 = "Switch to MINIDUMP :" fullword wide ascii
      $x13 = "[masterkey] with password: %s (%s user)" fullword wide
      $x14 = "Clear screen (doesn't work with redirections, like PsExec)" fullword wide
      $x15 = "** Session key is NULL! It means allowtgtsessionkey is not set to 1 **" fullword wide
      $x16 = "[masterkey] with DPAPI_SYSTEM (machine, then user): " fullword wide
   condition:
      (
         ( uint16(0) == 0x5a4d and 1 of ($x*) ) or
         ( 3 of them )
      )
      and not pe.imphash() == "77eaeca738dd89410a432c6bd6459907"
}

rule AppInitHook {
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 8"
   strings:
      $s0 = "\\Release\\AppInitHook.pdb" ascii
      $s1 = "AppInitHook.dll" fullword ascii
      $s2 = "mimikatz.exe" fullword wide
      $s3 = "]X86Instruction->OperandSize >= Operand->Length" fullword wide
      $s4 = "mhook\\disasm-lib\\disasm.c" fullword wide
      $s5 = "mhook\\disasm-lib\\disasm_x86.c" fullword wide
      $s6 = "VoidFunc" fullword ascii
   condition:
      uint16(0) == 0x5a4d and filesize < 500KB and 4 of them
}

rule HKTL_Mimikatz_SkeletonKey_in_memory_Aug20_1 {
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 9"
   strings:
      $x1 = { 60 ba 4f ca c7 44 24 34 dc 46 6c 7a c7 44 24 38 
              03 3c 17 81 c7 44 24 3c 94 c0 3d f6 }
   condition:
      1 of them
}

rule HKTL_mimikatz_memssp_hookfn {
   meta:
       description = "Detect the risk of Malware Mimikatz Rule 10"
   strings: 
      $xc1 = { 48 81 EC A8 00 00 00 C7 84 24 88 00 00 00 ?? ?? 
               ?? ?? C7 84 24 8C 00 00 00 ?? ?? ?? ?? C7 84 24 
               90 00 00 00 ?? ?? ?? 00 C7 84 24 80 00 00 00 61 
               00 00 00 C7 44 24 40 5B 00 25 00 C7 44 24 44 30 
               00 38 00 C7 44 24 48 78 00 3A 00 C7 44 24 4C 25 
               00 30 00 C7 44 24 50 38 00 78 00 C7 44 24 54 5D 
               00 20 00 C7 44 24 58 25 00 77 00 C7 44 24 5C 5A 
               00 5C 00 C7 44 24 60 25 00 77 00 C7 44 24 64 5A 
               00 09 00 C7 44 24 68 25 00 77 00 C7 44 24 6C 5A 
               00 0A 00 C7 44 24 70 00 00 00 00 48 8D 94 24 80 
               00 00 00 48 8D 8C 24 88 00 00 00 48 B8 A0 7D ?? 
               ?? ?? ?? 00 00 FF D0 } 
   condition: 
      $xc1 
}

rule mimikatz_lsass_mdmp_file
{
  meta:
    description   = "Detect the risk of Malware Mimikatz Rule 11"

  strings:
    $lsass      = "System32\\lsass.exe" wide nocase

  condition:
    (uint32(0) == 0x504d444d) and $lsass
}

rule mimikatz_kirbi_ticket
{
  meta:
    description   = "Detect the risk of Malware Mimikatz Rule 12"

  strings:
    $asn1     = { 76 82 ?? ?? 30 82 ?? ?? a0 03 02 01 05 a1 03 02 01 16 }

  condition:
    $asn1 at 0
}

rule lsadump
{
  meta:
    description   = "Detect the risk of Malware Mimikatz Rule 13"
    remarks   = "LSA dump programe (bootkey/syskey) - pwdump and others"
  strings:
    $str_sam_inc  = "\\Domains\\Account" ascii nocase
    $str_sam_exc  = "\\Domains\\Account\\Users\\Names\\" ascii nocase
    $hex_api_call = {(41 b8 | 68) 00 00 00 02 [0-64] (68 | ba) ff 07 0f 00 }
    $str_msv_lsa  = { 4c 53 41 53 52 56 2e 44 4c 4c 00 [0-32] 6d 73 76 31 5f 30 2e 64 6c 6c 00 }
    $hex_bkey   = { 4b 53 53 4d [20-70] 05 00 01 00}

  condition:
    ($str_sam_inc and not $str_sam_exc) or $hex_api_call or $str_msv_lsa or $hex_bkey
}

rule mimilove {
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 14"
   strings:
      $s1 = "$http://blog.gentilkiwi.com/mimikatz 0" fullword ascii 
      $s2 = "mimilove.exe" fullword wide 
      $s3 = " '## v ##'   https://blog.gentilkiwi.com/mimikatz             (oe.eo)" fullword wide 
      $s4 = "ERROR wmain ; OpenProcess (0x%08x)" fullword wide 
      $s5 = "ERROR mimilove_lsasrv ; kull_m_memory_copy / KIWI_MSV1_0_LOGON_SESSION_TABLE_50 (0x%08x)" fullword wide 
      $s6 = "ERROR mimilove_lsasrv ; LogonSessionTable is NULL" fullword wide 
      $s7 = "ERROR mimilove_kerberos ; kull_m_memory_copy / KERB_HASHPASSWORD_5 (0x%08x)" fullword wide 
      $s8 = "ERROR mimilove_kerberos ; kull_m_memory_copy / KIWI_KERBEROS_LOGON_SESSION_50 (0x%08x)" fullword wide 
      $s9 = "ERROR mimilove_kerberos ; KerbLogonSessionList is NULL" fullword wide 
      $s10 = "ERROR mimilove_kerberos ; kull_m_memory_copy / KIWI_KERBEROS_KEYS_LIST_5 (0x%08x)" fullword wide 
      $s11 = "ERROR kull_m_kernel_ioctl_handle ; DeviceIoControl (0x%08x) : 0x%08x" fullword wide 
      $s12 = "UndefinedLogonType" fullword wide 
      $s13 = "ERROR wmain ; GetVersionEx (0x%08x)" fullword wide 
      $s14 = "ERROR mimilove_lsasrv ; kull_m_memory_copy / KIWI_MSV1_0_PRIMARY_CREDENTIALS (0x%08x)" fullword wide 
      $s15 = "ERROR mimilove_lsasrv ; kull_m_memory_copy / KIWI_MSV1_0_CREDENTIALS (0x%08x)" fullword wide 
      $s16 = "KERBEROS Credentials (no tickets, sorry)" fullword wide 
      $s17 = "Copyright (c) 2007 - 2021 gentilkiwi (Benjamin DELPY)" fullword wide 
      $s18 = "benjamin@gentilkiwi.com0" fullword ascii 
      $s19 = " * Username : %wZ" fullword wide 
      $s20 = "http://subca.ocsp-certum.com01" fullword ascii 

      $op0 = { 89 45 cc 6a 34 8d 45 cc 50 8d 45 c4 8d 4d 80 50 }
      $op1 = { 89 45 b8 c7 45 bc f7 ff ff ff 89 5d d4 89 5d f4 }
      $op2 = { 89 45 d4 c7 45 d8 f8 ff ff ff 89 7d f0 89 7d f4 }
   condition:
      uint16(0) == 0x5a4d and filesize < 100KB and
      ( 8 of them and all of ($op*) )
}

rule mimi_anti {
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 15"
   strings:
      $s1 = "curity><requestedPrivileges><requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel></requeste" ascii 
      $s2 = "mZXixFpg.exe" fullword wide 
      $s3 = "hemas.microsoft.com/SMI/2005/WindowsSettings\">true</dpiAware></windowsSettings></application></assembly>" fullword ascii 
      $s4 = "Copyright (c) 2007 - 2020 bIJ9xgPw5o (eTZHxXXY 52DdH)" fullword wide 
      $s5 = "GcircTRv" fullword ascii 
      $s6 = "acossqrt" fullword ascii 
      $s7 = "baagqqq" fullword ascii 
      $s8 = "nnmdjjj" fullword ascii 
      $s9 = "jklmnop" fullword ascii 
      $s10 = "onoffalsey" fullword ascii 
      $s11 = "NCKeyD`<d" fullword ascii 
      $s12 = "lCorE.Proces" fullword ascii 
      $s13 = "RRR.uuu" fullword ascii 
      $s14 = " erroFail" fullword ascii 
      $s15 = "Q.0F:\\" fullword ascii 
      $s16 = ".c:%d:%" fullword ascii 
      $s17 = "CHPJHAT" fullword ascii 
      $s18 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii 
      $s19 = "vileges></security></trustInfo><application xmlns=\"urn:schemas-microsoft-com:asm.v3\"><windowsSettings><dpiAware xmlns=\"http:/" ascii 
      $s20 = " @-OPrAT" fullword ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 2000KB and  8 of them
}

rule mimi_anti1 {
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 16"
   strings:
      $s1 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii 
      $s2 = "gSAMLIB.dll" fullword ascii 
      $s3 = "QVERSION.dll" fullword ascii 
      $s4 = "mimikatz.exe" fullword wide 
      $s5 = "yCRYPT32.dll" fullword ascii 
      $s6 = "YSHLWAPI.dll" fullword ascii 
      $s7 = "Pmsasn1.dll" fullword ascii 
      $s8 = "[cWINSTA.dll" fullword ascii 
      $s9 = "curity><requestedPrivileges><requestedExecutionLevel level=\"requireAdministrator\" uiAccess=\"false\"></requestedExecutionLevel" ascii 
      $s10 = "7http://sha256timestamp.ws.symantec.com/sha256/timestamp0" fullword ascii 
      $s11 = "www.microsoft.com0" fullword ascii 
      $s12 = "=\"http://schemas.microsoft.com/SMI/2005/WindowsSettings\">true</dpiAware></windowsSettings></application></assembly>" fullword ascii 
      $s13 = "mimikatz" fullword wide 
      $s14 = "Copyright (c) 2007 - 2019 gentilkiwi (Benjamin DELPY)" fullword wide 
      $s15 = "mimikatz for Windows" fullword wide 
      $s16 = "U:\"QS6" fullword ascii 
      $s17 = "fjN.TRl" fullword ascii 
      $s18 = "^f:\"Oh" fullword ascii 
      $s19 = "QZ0S.aLe" fullword ascii 
      $s20 = "3%i:^3" fullword ascii 
   condition:
      uint16(0) == 0x5a4d and filesize < 18000KB and 8 of them
}

rule mimi_anti2 {
   meta:
      description = "Detect the risk of Malware Mimikatz Rule 17"
   strings:
      $s1 = "mimikatz.exe" fullword wide 
      $s2 = "curity><requestedPrivileges><requestedExecutionLevel level=\"asInvoker\" uiAccess=\"false\"></requestedExecutionLevel></requeste" ascii 
      $s3 = "7http://sha256timestamp.ws.symantec.com/sha256/timestamp0" fullword ascii 
      $s4 = "www.microsoft.com0" fullword ascii 
      $s5 = "hemas.microsoft.com/SMI/2005/WindowsSettings\">true</dpiAware></windowsSettings></application></assembly>" fullword ascii 
      $s6 = "mimikatz" fullword wide 
      $s7 = "Copyright (c) 2007 - 2019 gentilkiwi (Benjamin DELPY)" fullword wide 
      $s8 = "msncucx" fullword ascii 
      $s9 = "ashcjsm" fullword ascii 
      $s10 = "lsmcpst" fullword ascii 
      $s11 = "iRNG9+ >" fullword ascii 
      $s12 = "mzhn9+ " fullword ascii 
      $s13 = "mimikatz for Windows" fullword wide 
      $s14 = "yDT:\\pE" fullword ascii 
      $s15 = "RiRC<m" fullword ascii 
      $s16 = "<assembly xmlns=\"urn:schemas-microsoft-com:asm.v1\" manifestVersion=\"1.0\"><trustInfo xmlns=\"urn:schemas-microsoft-com:asm.v3" ascii 
      $s17 = "GEt:h5Wm" fullword ascii 
      $s18 = "Zlaocpz" fullword ascii 
      $s19 = "Qnsfqlc" fullword ascii 
      $s20 = "vileges></security></trustInfo><application xmlns=\"urn:schemas-microsoft-com:asm.v3\"><windowsSettings><dpiAware xmlns=\"http:/" ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 18000KB and 8 of them
}


rule FrpRule1{
   meta:
      description = "Detect the risk of Malware Frp Rule 1"
   strings:
      $x1 = "casgstatus: waiting for Gwaiting but is Grunnablechacha20poly1305: bad nonce length passed to Openchacha20poly1305: bad nonce le" ascii 
      $x2 = "Unexpected argument to `immutable`VirtualQuery for stack base failed^((\\d{4}-)?\\d{3}-\\d{3}(-\\d{1})?)?$adding nil Certificate" ascii 
      $x3 = "28421709430404007434844970703125: day-of-year does not match dayAssociate to %v blocked by rulesCertAddCertificateContextToStore" ascii 
      $x4 = "webpackJsonp([0],[function(e,t,o){var r=o(159);\"string\"==typeof r&&(r=[[e.i,r,\"\"]]);var n={hmr:!0};n.transform=void 0,n.inse" ascii 
      $x5 = " 2020 Denis Pushkarev (zloirock.ru)\"})},function(e,t){var o=Math.ceil,r=Math.floor;e.exports=function(e){return isNaN(e=+e)?0:(" ascii 
      $x6 = "target must be an absolute URL or an absolute path: %qtls: certificate used with invalid signature algorithmtls: client indicate" ascii 
      $x7 = "entersyscallexcludesrunefloat32Slicefloat64SlicegcBitsArenasgcpacertracegetaddrinfowhost is downhtml_encodedhttp2debug=1http2deb" ascii 
      $x8 = "Go pointer stored into non-Go memoryHeader called after Handler finishedHijack failed on protocol switch: %vIA5String contains i" ascii 
      $x9 = " because it doesn't contain any IP SANs2006-01-02 15:04:05.999999999 -0700 MST277555756156289135105907917022705078125Bad param n" ascii 
      $x10 = "Subject: AMDisbetter!AuthenticAMDBidi_ControlCIDR addressCONTINUATIONCentaurHaulsCoCreateGuidContent TypeContent-TypeCookie.Valu" ascii 
      $x11 = "Simply type handle tcp work connection, use_encryption: %t, use_compression: %treconstruction required as one or more required d" ascii 
      $x12 = "Unexpected argument to `proxy-revalidate`WriteHeader called after Handler finished[ERR] yamux: Invalid protocol version: %dasn1:" ascii 
      $x13 = "getenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shpack: string too longhttp2: frame too l" ascii 
      $x15 = "InitiateSystemShutdownExWIsValidSecurityDescriptorKaliningrad Standard TimeMiddle East Standard TimeNew Zealand Standard TimeNor" ascii 
      $x16 = ".WithDeadline(.in-addr.arpa.127.0.0.1:70001907348632812595367431640625: extra text: <not Stringer>Accept-CharsetCertCloseStoreCo" ascii 
      $x17 = "flate: internal error: function %q not definedgarbage collection scangcDrain phase incorrectgo with non-empty framehttp2: handle" ascii 
      $x18 = "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-3[0-9a-fA-F]{3}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$x509: signature check attempts limit reached while" ascii 
      $x19 = "non-IPv4 addressnon-IPv6 addressobject is remotepacer: H_m_prev=plugin_http_userplugin_unix_pathproxy-connectionquoted-printable" ascii 
      $x20 = "span set block with unpopped elements found in resettls: internal error: session ticket keys unavailabletls: private key type do" ascii 
   condition:
      uint16(0) == 0x5a4d and filesize < 32000KB and 6 of ( $x* )
}

rule FrpRule2{
   meta:
      description = "Detect the risk of Malware Frp Rule 2"
   strings:
      $x1 = "Unexpected argument to `immutable`^((\\d{4}-)?\\d{3}-\\d{3}(-\\d{1})?)?$adding nil Certificate to CertPoolbad scalar length: %d," ascii 
      $x2 = "webpackJsonp([0],[function(e,t,o){var r=o(159);\"string\"==typeof r&&(r=[[e.i,r,\"\"]]);var n={hmr:!0};n.transform=void 0,n.inse" ascii 
      $x3 = "/etc/pki/tls/certs/ca-bundle.crt28421709430404007434844970703125: day-of-year does not match dayAssociate to %v blocked by rules" ascii 
      $x4 = " 2020 Denis Pushkarev (zloirock.ru)\"})},function(e,t){var o=Math.ceil,r=Math.floor;e.exports=function(e){return isNaN(e=+e)?0:(" ascii 
      $x5 = "bytes.Buffer: reader returned negative count from Readcertificate is not valid for requested server name: %wcryptobyte: Builder " ascii 
      $x6 = "got CONTINUATION for stream %d; expected stream %dheartbeat goroutine for udp work connection closedhttp: putIdleConn: CloseIdle" ascii 
      $x7 = "strings.Builder.Grow: negative countsyntax error scanning complex numbertls: keys must have at least one keytls: server did not " ascii 
      $x8 = "Go pointer stored into non-Go memoryHeader called after Handler finishedHijack failed on protocol switch: %vIA5String contains i" ascii 
      $x9 = "runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangeslice bounds out of range [:%x] with" ascii 
      $x10 = "heapBitsSetTypeGCProg: small allocationhttp: putIdleConn: keep alives disabledinvalid indexed representation index %dlocal_port " ascii 
      $x11 = "http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing co" ascii 
      $x12 = "casgstatus: waiting for Gwaiting but is Grunnablechacha20poly1305: bad nonce length passed to Openchacha20poly1305: bad nonce le" ascii 
      $x13 = "non-IPv4 addressnon-IPv6 addressobject is remotepacer: H_m_prev=plugin_http_userplugin_unix_pathproxy-connectionquoted-printable" ascii 
      $x14 = "Only unicode is supportedPost webhook failed %s %dShellCompDirectiveDefaultShellCompDirectiveNoSpaceUnrecognized address type^(?" ascii 
      $x15 = "173472347597680709441192448139190673828125867361737988403547205962240695953369140625Error while parsing flags from args %v: %sFa" ascii 
      $x16 = "getenv before env initgzip: invalid checksumheadTailIndex overflowheader field %q = %q%shpack: string too longhttp2: frame too l" ascii 
      $x17 = "span set block with unpopped elements found in resettls: internal error: session ticket keys unavailabletls: private key type do" ascii 
      $x18 = "http: RoundTripper implementation (%T) returned a nil *Response with a nil errortls: either ServerName or InsecureSkipVerify mus" ascii 
      $x19 = "Unexpected argument to `proxy-revalidate`WriteHeader called after Handler finished[ERR] yamux: Invalid protocol version: %dasn1:" ascii 
      $x20 = " to non-Go memory , locked to thread/etc/nsswitch.conf/etc/pki/tls/certs298023223876953125404 page not found407 Not authorized: " ascii 
   condition:
      uint16(0) == 0x457f and filesize < 31000KB and
      6 of ($x*)
}

rule VenomRule1 {
   meta:
      description = "Detect the risk of Malware Venom Rule 1"
   strings:
      $x1 = ".lib section in a.out corrupted11368683772161602973937988281255684341886080801486968994140625Central Brazilian Standard TimeMoun" ascii 
      $x2 = "CertEnumCertificatesInStoreEaster Island Standard TimeG waiting list is corruptedStartServiceCtrlDispatcherW[-]Can not find targ" ascii 
      $x3 = " to unallocated span%%!%c(*big.Float=%s)37252902984619140625: leftover defer sp=Arabic Standard TimeAzores Standard TimeCertOpen" ascii 
      $x4 = "127.0.0.1:%d152587890625762939453125Bidi_ControlCreateEventWGetAddrInfoWGetConsoleCPGetLastErrorGetLengthSidGetStdHandleGetTempP" ascii 
      $x5 = "ssh: unmarshal error for field %s of type %s%sstopTheWorld: not stopped (status != _Pgcstop)x509: invalid elliptic curve private" ascii 
      $x6 = " > (den<<shift)/2syntax error scanning numberx509: unknown elliptic curve45474735088646411895751953125Central America Standard T" ascii 
      $x7 = "ssh: channel response message received on inbound channelsync: WaitGroup misuse: Add called concurrently with Waitx509: failed t" ascii 
      $x8 = " of unexported method previous allocCount=%s flag redefined: %s186264514923095703125931322574615478515625AdjustTokenPrivilegesAl" ascii 
      $x9 = "unknown network workbuf is empty initialHeapLive= spinningthreads=%%!%c(big.Int=%s)0123456789ABCDEFX0123456789abcdefx06010215040" ascii 
      $x10 = "unixpacketunknown pcws2_32.dll  of size   (targetpc= gcwaiting= gp.status= heap_live= idleprocs= in status  m->mcache= mallocing" ascii 
      $x11 = "Variation_Selector[-]Read file error[-]Separator errorbad manualFreeListbufio: buffer fullconnection refusedcontext.Backgroundec" ascii 
      $x12 = "Pakistan Standard TimeParaguay Standard TimeSakhalin Standard TimeTasmania Standard TimeWaitForMultipleObjects[+]Remote connecti" ascii 
      $x13 = "file descriptor in bad statefindrunnable: netpoll with pgcstopm: negative nmspinninginvalid runtime symbol tablelarge span treap" ascii 
      $x14 = " lockedg= lockedm= m->curg= method:  ms cpu,  not in [ runtime= s.limit= s.state= threads= u_a/u_g= wbuf1.n= wbuf2.n=%!(EXTRA (M" ascii 
      $x15 = "bytes.Buffer: reader returned negative count from Readfmt: scanning called UnreadRune with no rune availablegcControllerState.fi" ascii 
      $x16 = "et nodeaddress not a stack addressadministratively prohibitedc:\\windows\\system32\\cmd.exechannel number out of rangecommunicat" ascii 
      $x17 = "tifier removedindex out of rangeinput/output errormultihop attemptedno child processesno locks availablenon-minimal lengthoperat" ascii 
      $x18 = "invalid network interface nameinvalid pointer found on stacknode is not its parent's childnotetsleep - waitm out of syncprotocol" ascii 
      $x19 = "bad flushGen bad map statechannelEOFMsgdalTLDpSugct?disconnectMsgempty integerexchange fullfatal error: gethostbynamegetservbyna" ascii 
      $x20 = "structure needs cleaningunexpected exponent baseunexpected mantissa baseunknown channel type: %v bytes failed with errno= to unu" ascii 
   condition:
      uint16(0) == 0x5a4d and filesize < 10000KB and 3 of ($x*) 
}

rule VenomRule2 {
   meta:
      description = "Detect the risk of Malware Venom Rule 2"
   strings:
      $x1 = "non-IPv4 addressnon-IPv6 addressobject is remotepacer: H_m_prev=reflect mismatchregexp: Compile(remote I/O errorruntime:  g:  g=" ascii 
      $x2 = ".lib section in a.out corrupted11368683772161602973937988281255684341886080801486968994140625SIGSEGV: segmentation violation[-]D" ascii 
      $x3 = "lock: lock countslice bounds out of rangesocket type not supportedstartm: p has runnable gsstoplockedm: not runnablethe node is " ascii 
      $x4 = "sync: WaitGroup misuse: Add called concurrently with Waitthe port %d is successfully listening on the remote node!The `password`" ascii 
      $x6 = " > (den<<shift)/2syntax error scanning numberunsupported compression for you should select node first454747350886464118957519531" ascii 
      $x8 = " of unexported method previous allocCount=%s flag redefined: %s186264514923095703125931322574615478515625Anatolian_HieroglyphsFl" ascii 
      $x9 = "file descriptor in bad statefindrunnable: netpoll with pgcstopm: negative nmspinninginvalid runtime symbol tablelarge span treap" ascii 
      $x10 = " to unallocated span%%!%c(*big.Float=%s)/usr/share/zoneinfo/37252902984619140625: leftover defer sp=Bar pool was startedEgyptian" ascii 
      $x11 = "173472347597680709441192448139190673828125867361737988403547205962240695953369140625MapIter.Value called on exhausted iterator[-" ascii 
      $x12 = " H_T= H_a= H_g= MB,  W_a= and  cnt= h_a= h_g= h_t= max= ptr  siz= tab= top= u_a= u_g=%%%dd%s %d%s %s%s%dh%s:%d+ -- , ..., fp:/et" ascii 
      $x13 = "garbage collection scangcDrain phase incorrectinterrupted system callinvalid escape sequenceinvalid m->lockedInt = left over mar" ascii 
      $x15 = "unixpacketunknown pc  of size   (targetpc= gcwaiting= gp.status= heap_live= idleprocs= in status  m->mcache= mallocing= ms clock" ascii 
      $s16 = "/dev/urandom127.0.0.1:%d127.0.0.1:53152587890625762939453125Bidi_ControlCIDR addressI/O possibleInstAltMatchJoin_ControlMeetei_M" ascii    
      $s18 = "runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: stat underflow: val runtime: sudog with non-nil cruntime: unk" ascii 
      $s19 = "runtime:greyobject: checkmarks finds unexpected unmarked object obj=this file is too large(>100M), do you still want to upload i" ascii 
      $s20 = "bytes.Buffer: reader returned negative count from Readfmt: scanning called UnreadRune with no rune availablegcControllerState.fi" ascii 
   condition:
      uint16(0) == 0x457f and filesize < 9000KB and
      2 of ($x*) and 2 of ($s*)
}

rule VenomRule3 {
   meta:
      description = "Detect the risk of Malware Venom Rule 3"
   strings:
      $x1 = "runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangessh: unmarshal error for field %s of" ascii 
      $x2 = "Failed to deserialize context %sSIGFPE: floating-point exceptionSIGTTOU: background write to tty[+]Connect to a new node success" ascii 
      $x3 = "173472347597680709441192448139190673828125867361737988403547205962240695953369140625Failed to parse goroutine ID out of %q: %vPR" ascii 
      $x4 = "%s flag redefined: %s186264514923095703125931322574615478515625Anatolian_HieroglyphsError: No such loggerFloat.SetFloat64(NaN)In" ascii 
      $x5 = "0123456789ABCDEFX0123456789abcdefx060102150405Z07001192092895507812559604644775390625: missing method ; SameSite=StrictCOMPRESSI" ascii 
      $x6 = "%{([a-z]+)(?::(.*?[^\\\\]))?}' to delete iptables rules.363797880709171295166015625DATA frame with stream ID 0G waiting list is " ascii 
      $x7 = "reflect.Value.Bytes of non-byte slicereflect.Value.Bytes of non-rune slicereflect.Value.Convert: value of type reflect: Bits of " ascii 
      $x8 = "heapBitsSetTypeGCProg: small allocationhttp: putIdleConn: keep alives disabledinvalid indexed representation index %dmismatched " ascii 
      $x9 = "lock: lock countslice bounds out of rangeslice of unsupported typesocket type not supportedssh: handshake failed: %vssh: padding" ascii 
      $x10 = "ssh connect to target node error: %sssh: StdinPipe after process startedssh: overflow reading version stringssh: tcpChan: deadli" ascii 
      $x11 = ".lib section in a.out corrupted11368683772161602973937988281255684341886080801486968994140625Network Authentication RequiredPRIO" ascii 
      $x12 = " > (den<<shift)/2syntax error scanning numbertls: bad X25519 public valueunexpected end of JSON inputunexpected protocol version" ascii 
      $x13 = "Time.MarshalBinary: zone offset has fractional minute[-]Socks consult transfer mode or parse target error:bufio.Scan: too many e" ascii 
      $x14 = "file descriptor in bad statefindrunnable: netpoll with pgchelperstart: bad m->helpgcgcstopm: negative nmspinninggeneral SOCKS se" ascii 
      $x15 = "protobuf tag not enough fields in reflect.FuncOf: too many argumentsreflect: Field index out of boundsreflect: Method index out " ascii 
      $x16 = "crypto/tls: ExportKeyingMaterial is unavailable when renegotiation is enabled%{time:2006-01-02 15:04:05.000000} %{level} %{modul" ascii 
      $x17 = "runtime: p.gcMarkWorkerMode= runtime: split stack overflowruntime: stat underflow: val runtime: sudog with non-nil cruntime: unk" ascii 
      $x18 = "got CONTINUATION for stream %d; expected stream %dhttp: not caching alternate protocol's connectionshttp: putIdleConn: CloseIdle" ascii 
      $x19 = "http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing co" ascii 
      $x20 = "a message with extensions, but no extensions field in bytes.Buffer: reader returned negative count from Readfmt: scanning called" ascii 
   condition:
      uint16(0) == 0x457f and filesize < 23000KB and
      10 of ($x*)
}


rule PystingerRule1 {
   meta:
      description = "Detect the risk of Malware Pystinger Rule 1"
   strings:
      $s1 = "Failed to get address for PyImport_ExecCodeModule" fullword ascii 
      $s2 = "Failed to get address for Py_NoUserSiteDirectory" fullword ascii 
      $s3 = "Failed to get executable path." fullword ascii 
      $s4 = "Failed to execute script %s" fullword ascii 
      $s5 = "Failed to get address for PyMarshal_ReadObjectFromString" fullword ascii 
      $s6 = "Failed to get address for Py_FileSystemDefaultEncoding" fullword ascii 
      $s7 = "Failed to get address for PyRun_SimpleString" fullword ascii 
      $s8 = "Failed to get address for PyUnicode_DecodeFSDefault" fullword ascii 
      $s9 = "Failed to get address for PyUnicode_Decode" fullword ascii 
      $s10 = "GVDVFVEVG" fullword ascii 
      $s11 = "Failed to get address for Py_NoSiteFlag" fullword ascii 
      $s12 = "Failed to get address for PySys_AddWarnOption" fullword ascii 
      $s13 = "Failed to get address for PyErr_Clear" fullword ascii 
      $s14 = "Failed to get address for Py_DecRef" fullword ascii 
      $s15 = "Failed to get address for PyEval_EvalCode" fullword ascii 
      $s16 = "Failed to get address for Py_BuildValue" fullword ascii 
      $s17 = "Failed to get address for PyErr_Print" fullword ascii 
      $s18 = "Failed to get address for _Py_char2wchar" fullword ascii 
      $s19 = "logging.config(" fullword ascii 
      $s20 = "Error loading Python DLL '%s'." fullword ascii 
   condition:
      uint16(0) == 0x5a4d and filesize < 13000KB and 8 of them
}

rule PystingerRule2 {
   meta:
      description = "Detect the risk of Malware Pystinger Rule 2"
   strings:
      $s1 = "Failed to execute script %s" fullword ascii 
      $s2 = "Fatal error: unable to decode the command line argument #%i" fullword ascii 
      $s3 = "logging.config(" fullword ascii 
      $s4 = "Failed to get _MEIPASS as PyObject." fullword ascii 
      $s5 = "Cannot dlsym for PyImport_ExecCodeModule" fullword ascii 
      $s6 = "pyi-bootloader-ignore-signals" fullword ascii 
      $s7 = "http.cookies(" fullword ascii 
      $s8 = "wsgiref.headers(" fullword ascii 
      $s9 = "Installing PYZ: Could not get sys.path" fullword ascii 
      $s10 = "Failed to convert Wflag %s using mbstowcs (invalid multibyte string)" fullword ascii 
      $s11 = "Error loading Python lib '%s': dlopen: %s" fullword ascii 
      $s12 = "pyi-runtime-tmpdir" fullword ascii 
      $s13 = "http.client(" fullword ascii 
      $s14 = "e /p p$p8p4p," fullword ascii 
      $s15 = "* s1_>" fullword ascii 
      $s16 = "Could not get __main__ module." fullword ascii 
      $s17 = "'6-2=2#232+" fullword ascii 
      $s18 = "bunicodedata.so" fullword ascii 
      $s19 = "boperator.so" fullword ascii 
      $s20 = "Could not get __main__ module's dict." fullword ascii 
   condition:
      uint16(0) == 0x457f and filesize < 19000KB and
      8 of them
}

rule EarthWormRule1
{
    meta:
       description = "Detect the risk of Malware EarthWorm Rule 1"
    strings:
        $elf = {7f 45 4c 46}
        $string_1 = "I_AM_NEW_RC_CMD_SOCK_CLIENT"
        $string_2 = "CONFIRM_YOU_ARE_SOCK_CLIENT"
        $string_3 = "SOCKSv4 Not Support now!"
        $string_4 = "rssocks cmd_socket OK!"

    condition:
        $elf at 0 and 2 of them
}

rule EarthWormRule2
{
 meta:
    description = "Detect the risk of Malware EarthWorm Rule 2"
    strings:
        $elf = {7f 45 4c 46}
        $string_1 = "File data send OK!"
        $string_2 = "please set the target first"
        $string_3 = "It support various OS or CPU.For example"
        $string_4 = "xxx -l [lport] -n [name]"

condition:
    $elf at 0 and 2 of them
}

rule EarthWormRule3{
   meta:
      description = "Detect the risk of Malware EarthWorm Rule 3"
   strings:
      $s1 = " ./ew -s lcx_tran --listenport 1080 -connhost xxx.xxx.xxx.xxx --connport 8888" fullword ascii 
      $s2 = " ./ew -s rssocks --refHost xxx.xxx.xxx.xxx --refPort 8888" fullword ascii 
      $s3 = " -d refhost set the reflection host address." fullword ascii 
      $s4 = " ./ew -s lcx_slave --refhost [ref_ip] --refport 1080 -connhost [connIP] --connport 8888" fullword ascii 
      $s5 = " -f connhost set the connect host address ." fullword ascii 
      $s6 = "<-- %3d --> (open)used/unused  %d/%d" fullword ascii 
      $s7 = "lcx_tran 0.0.0.0:%d <--[%4d usec]--> %s:%d" fullword ascii 
      $s8 = "Error : --> %d start server." fullword ascii 
      $s9 = "ssocksd 0.0.0.0:%d <--[%4d usec]--> socks server" fullword ascii 
      $s10 = "rcsocks 0.0.0.0:%d <--[%4d usec]--> 0.0.0.0:%d" fullword ascii 
      $s11 = "Error : bind port %d ." fullword ascii 
      $s12 = "--> %3d <-- (close)used/unused  %d/%d" fullword ascii 
      $s13 = "Error on connect %s:%d [proto_init_cmd_rcsocket]" fullword ascii 
      $s14 = " Tcp ---> %s:%d " fullword ascii 
      $s15 = " ./ew -s lcx_listen --listenPort 1080 --refPort 8888" fullword ascii 
      $s16 = " ./ew -s ssocksd --listenport 1080" fullword ascii 
      $s17 = " -e refport set the reflection port." fullword ascii 
      $s18 = " -g connport set the connect port." fullword ascii 
      $s19 = "Error : Could not create socket [ port = %d ]." fullword ascii 
      $s20 = " ./ew -s rcsocks --listenPort 1080 --refPort 8888" fullword ascii 
   condition:
      uint16(0) == 0x5a4d and filesize < 200KB and 8 of them
}

rule NPSRule1 {
   meta:
      description = "Detect the risk of Malware NPS Rule 1"
   strings:
      $x1 = "slice bounds out of range [:%x] with length %ystopTheWorld: not stopped (status != _Pgcstop)sysGrow bounds not aligned to palloc" ascii 
      $x2 = "FilledVerySmallSquare;Georgian Standard TimeGetControllerAndActionGetEnvironmentStringsWGetTimeZoneInformationHawaiian Standard " ascii 
      $x3 = "lock: lock countservice %s already existsservice function disabledslice bounds out of rangesnappy: unsupported inputsocket type " ascii 
      $x4 = "tag handle must contain alphanumerical characters onlytarget must be an absolute URL or an absolute path: %qtls: certificate use" ascii 
      $x5 = "%sidentifier on left side of :=ilnpv6 locator update messageinteger not minimally-encodedinternal error: took too muchinvalid bl" ascii 
      $x6 = "flate: internal error: function %q not definedgarbage collection scangcDrain phase incorrecthealth_check_max_failedhtml/template" ascii 
      $x7 = "Subject: AMDisbetter!AVX512BITALGAuthenticAMDBeegoVersionBidi_ControlCIDR addressCONTENT_TYPECONTINUATIONCentaurHaulsCircleMinus" ascii 
      $x8 = "sender tried to send more than declared Content-Length of %d bytestls: certificate private key (%T) does not implement crypto.Si" ascii 
      $x9 = "debugPtrmask.lockdecryption faileddeprecated formatdiscarded samplesdownharpoonright;entersyscallblockexec format errorexec: not" ascii 
      $x10 = "%s %s:%d s=%d, gp->status=, not pointer,\"filename\":\"-byte block (/([^.]+).(.+)/debug/pprof//etc/rc.d/K02/etc/rc.d/S9038146972" ascii 
      $x11 = "%s.%s.ka.acme.invalid(?m)^\\[[^\\[\\]\\r\\n]+\\](SpinLock::)?Unlock.*, levelBits[level] = 18626451492309570312593132257461547851" ascii 
      $x12 = "    beego.GlobalControllerRouter[\"acme/autocert: no token cert for %qacme: certificate chain is too deepacme: certificate chain" ascii 
      $x13 = "%s \"%s\"__restoreandslope;angmsdaa;angmsdab;angmsdac;angmsdad;angmsdae;angmsdaf;angmsdag;angmsdah;angrtvbd;approxeq;assets_jsat" ascii 
      $x14 = "WriteHeader called after Handler finishedapplication/vndnokiaconfiguration-messageasn1: internal error in parseTagAndLengthbinar" ascii 
      $x15 = "Stack traces of holders of contended mutexesapplication/x-bytecodeelisp=(compiled=elisp)cipher: NewGCM requires 128-bit block ci" ascii 
      $x16 = "%s.%s.acme.invalid(Mutex::)?Unlock.*, locked to thread/debug/pprof/trace1 or 2 expressions114.114.114.114:5329802322387695312540" ascii 
      $x17 = "runtime: typeBitsBulkBarrier without typeseconds and debug params are incompatiblesetCheckmarked and isCheckmarked disagreestart" ascii 
      $x18 = "UnsubscribeServiceChangeNotifications_cgo_notify_runtime_init_done missingacme/autocert: Manager.Prompt not setacme/autocert: ce" ascii 
      $x19 = "MapIter.Value called before NextMultiple ,inline maps in struct NtWow64QueryInformationProcess64SYSTEM\\CurrentControlSet\\Contr" ascii 
      $x20 = "            Method: \"bufio.Scanner: SplitFunc returns advance count beyond inputcannot create Encoder with more than 256 data+p" ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 36000KB and 3 of ( $x* )
}

rule NPSRule2 {
   meta:
      description = "Detect the risk of Malware NPS Rule 2"
   strings:
      $x1 = "runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangeslice bounds out of range [:%x] with" ascii 
      $x2 = "lock: lock countservice function disabledslice bounds out of rangesnappy: unsupported inputsocket type not supportedstartm: p ha" ascii 
      $x3 = "FilledVerySmallSquare;GetControllerAndActionInscriptional_ParthianInt.Scan: invalid verbMAX_CONCURRENT_STREAMSNegativeVeryThinSp" ascii 
      $x4 = "got CONTINUATION for stream %d; expected stream %dhttp: putIdleConn: CloseIdleConnections was calledhttp: suspiciously long trai" ascii 
      $x5 = "_cgo_notify_runtime_init_done missingacme/autocert: Manager.Prompt not setacme/autocert: certificate cache missacme/autocert: un" ascii 
      $x6 = "acme/autocert: host %q not configured in HostWhitelistapplication/vnd.ms-powerpoint.template.macroEnabled.12bytes.Buffer: reader" ascii 
      $x7 = "debugPtrmask.lockdecryption faileddeprecated formatdiscarded samplesdownharpoonright;entersyscallblockexec format errorexec: not" ascii 
      $x8 = "Stack traces of holders of contended mutexesapplication/x-bytecodeelisp=(compiled=elisp)cipher: NewGCM requires 128-bit block ci" ascii 
      $x9 = "WriteHeader called after Handler finishedapplication/vndnokiaconfiguration-messageasn1: internal error in parseTagAndLengthbinar" ascii 
      $x10 = "x509: PKCS#8 wrapping contained private key with unknown algorithm: %vapplication/vnd.openxmlformats-officedocument.wordprocessi" ascii 
      $x11 = "%s.%s.acme.invalid(Mutex::)?Unlock.*, locked to thread/debug/pprof/trace/etc/nsswitch.conf/etc/openssl/certs/etc/pki/tls/certs1 " ascii 
      $x12 = "%s.%s.ka.acme.invalid(?m)^\\[[^\\[\\]\\r\\n]+\\](SpinLock::)?Unlock.*, levelBits[level] = 18626451492309570312593132257461547851" ascii 
      $x13 = "flate: internal error: function %q not definedgarbage collection scangcDrain phase incorrectgroup: unknown groupid health_check_" ascii 
      $x14 = "    beego.GlobalControllerRouter[\"acme/autocert: no token cert for %qacme: certificate chain is too deepacme: certificate chain" ascii 
      $x15 = "173472347597680709441192448139190673828125867361737988403547205962240695953369140625Failed to parse goroutine ID out of %q: %vLo" ascii 
      $x16 = "= but have  flushGen  for type  gfreecnt= pages at  returned  runqsize= runqueue= s.base()= spinning= stopwait= stream=%d sweepg" ascii 
      $x17 = "heap profile: *(\\d+): *(\\d+) *\\[ *(\\d+): *(\\d+) *\\] @ fragmentationzhttp2: Transport conn %p received error from processin" ascii 
      $x18 = "x509: unknown elliptic curvexz: block header not writtenxz: checksum error for blockxz: record %d is %v; want %vxz: unsupported " ascii 
      $x19 = "__gnu_cxx::new_allocator::allocateacme/autocert: expired certificateacme/autocert: missing certificateacme/autocert: missing ser" ascii 
      $x20 = "net/http: skip alternate protocolpad size larger than data payloadpseudo header field after regularraw string literal not termin" ascii 
   condition:
      uint16(0) == 0x457f and filesize < 35000KB and
      8 of ($x*)
}

rule FscanRule1 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 1"
   strings:
      $s1 = "3c4c5c6c7c" ascii 
      $s2 = "ze/processOp:ons7" fullword ascii 
      $s3 = "sbGVjdGlU" fullword ascii 
      $s4 = "LjgzODQxND" fullword ascii 
      $s5 = "5c%: && '!''%'(" fullword ascii 
      $s6 = "L21qb2wvZXBk" fullword ascii 
      $s7 = "d0d1d2d3d5" ascii 
      $s8 = "ransport" fullword ascii 
      $s9 = "templaL" fullword ascii 
      $s10 = "runbcdl" fullword ascii 
      $s11 = "dxqp.USw" fullword ascii 
      $s12 = "\\.2334\\" fullword ascii 
      $s13 = "pgdll547" fullword ascii 
      $s14 = "IDENTIF" fullword ascii 
      $s15 = "THPINGPEPLUSPORTS" fullword ascii 
      $s16 = "* YpINp" fullword ascii 
      $s17 = "u^sYnRJgeT" fullword ascii 
      $s18 = "%'W* -" fullword ascii 
      $s19 = "* I!-," fullword ascii 
      $s20 = "6c3a.5e78" fullword ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 30000KB and 8 of them 
}

rule FscanRule2 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 2"
   strings:
      $s1 = "onmlkji" fullword ascii 
      $s2 = "pqrstu" fullword ascii 
      $s3 = "aGVycywgYW5" fullword ascii 
      $s4 = "U3ByaW5nQmxhZGU+" fullword ascii 
      $s5 = "MGFiY2RlZ" fullword ascii 
      $s6 = "YXBhY2hlL" fullword ascii 
      $s7 = "LjgzODQxNDMv" fullword ascii 
      $s8 = "ACLITEMP" fullword ascii 
      $s9 = "gethped" fullword ascii 
      $s10 = "bsddlln" fullword ascii 
      $s11 = "5c%: && '!''%" fullword ascii 
      $s12 = "IQtY:\\\\" fullword ascii 
      $s13 = "999!!!!" fullword ascii 
      $s14 = "\\2345\\." fullword ascii 
      $s15 = "*$xoLR:\\" fullword ascii 
      $s16 = "cceu:\"pt" fullword ascii 
      $s17 = ",getL0og" fullword ascii 
      $s18 = "%\"(5;-1," fullword ascii 
      $s19 = "* |iaH" fullword ascii 
      $s20 = "\";476837" fullword ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 30000KB and 8 of them
}

rule FscanRule3 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 3"
   strings:
      $s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii 
      $s2 = "ize/processOp" fullword ascii 
      $s3 = ".TGphdmEvdXR" fullword ascii 
      $s4 = "LjgzODQxNDM" fullword ascii 
      $s5 = "MGFiY2RlZ" fullword ascii 
      $s6 = "gethped" fullword ascii 
      $s7 = "CPRI * HTTP/2.0ZF" fullword ascii 
      $s8 = "\\:W!!!!" fullword ascii 
      $s9 = "333333i" fullword ascii 
      $s10 = "templaL" fullword ascii 
      $s11 = "U3ByaW5nQmxhZGU5" fullword ascii 
      $s12 = "GEYe\\h" fullword ascii 
      $s13 = "_/sys/kernel/mm/tf" fullword ascii 
      $s14 = "retkey " fullword ascii 
      $s15 = "4.3.3322!#6334" fullword ascii 
      $s16 = "2!0-3&023" fullword ascii 
      $s17 = "51`\"$$?." fullword ascii 
      $s18 = "]@`@%3\\0" fullword ascii 
      $s19 = "LoggyNF^" fullword ascii 
      $s20 = "4*+,<'-''.4" fullword ascii 
   condition:
      uint16(0) == 0x457f and filesize < 30000KB and
      8 of them
}

rule FscanRule4 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 4"

   strings:
      $x1 = "adding nil Certificate to CertPoolarray of non-uint8 in field %d: %Tbad scalar length: %d, expected %dcan't parse %q as a decima" ascii 
      $x2 = "runtime: text offset base pointer out of rangeruntime: type offset base pointer out of rangeschema_and_data_statement_mixing_not" ascii 
      $x3 = "non-IPv4 addressnon-IPv6 addressobject is remotepacer: H_m_prev=proxy-connectionreflect mismatchregexp: Compile(remote I/O error" ascii 
      $x4 = "ssh: overflow reading version stringssh: tcpChan: deadline not supportedstrings.Builder.Grow: negative countsyntax error scannin" ascii  
      $x6 = "heapBitsSetTypeGCProg: small allocationhttp: putIdleConn: keep alives disabledinvalid indexed representation index %dinvalid_arg" ascii  
      $x9 = "fdw_invalid_use_of_null_pointerfmt: unknown base; can't happenhttp2: connection error: %v: %vin literal null (expecting 'l')in l" ascii 
      $x10 = "Failed to send CommitXact with %vGODEBUG: no value specified for \"SIGCHLD: child status has changedSIGTTIN: background read fro" ascii 
      $x11 = "Closing TCP connectionDEBUG_HTTP2_GOROUTINESECDSAWithP256AndSHA256ECDSAWithP384AndSHA384ECDSAWithP521AndSHA512Entering Passive M" ascii 
      $x12 = "Command unrecognized.GSSAPI protocol errorInscriptional_PahlaviInternal Server ErrorOther_Grapheme_ExtendPrecondition RequiredRe" ascii 
      $x13 = "%v SSH public key was written successfully173472347597680709441192448139190673828125867361737988403547205962240695953369140625Ba" ascii 
      $x14 = "lock: lock countslice bounds out of rangeslice of unsupported typesocket type not supportedssh: handshake failed: %vssh: padding" ascii 
      $x15 = "x509: PKCS#8 wrapping contained private key with unknown algorithm: %vUnexpected character %c at index %d. Expected semi-colon o" ascii 
      $x16 = "streamSafe was not resetstructure needs cleaningtext/html; charset=utf-8unexpected ReadyForQueryunexpected buffer len=%vunknown " ascii 
      $x17 = "got CONTINUATION for stream %d; expected stream %dhttp: putIdleConn: CloseIdleConnections was calledhttp: suspiciously long trai" ascii 
      $x18 = "tls: server sent a ServerHello extension forbidden in TLS 1.3tls: unsupported certificate: private key is %T, expected *%Tx509: " ascii 
      $x19 = "http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing co" ascii 
      $x20 = "file descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcstopm: negative nmspinninggeneral SOCKS se" ascii 
   condition:
      uint16(0) == 0x457f and filesize < 22000KB and
      4 of ($x*)
}


rule FscanRule5 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 5"
   strings:
      $x1 = "Invalid field. Cannot determine length.Unable to find tree path for disconnectchain is not signed by an acceptable CAcipher: inc" ascii 
      $x2 = "VirtualQuery for stack base failedadding nil Certificate to CertPoolarray of non-uint8 in field %d: %Tbad scalar length: %d, exp" ascii 
      $x3 = "slice bounds out of range [:%x] with length %ysql/driver: couldn't convert %d into type boolsql/driver: couldn't convert %q into" ascii 
      $x4 = " > (den<<shift)/2string_data_right_truncationunexpected %q after error %sunexpected Parse response %qunexpected end of JSON inpu" ascii 
      $x5 = "non-IPv4 addressnon-IPv6 addressobject is remotepacer: H_m_prev=proxy-connectionreflect mismatchregexp: Compile(remote I/O error" ascii 
      $x6 = ".lib section in a.out corrupted11368683772161602973937988281255684341886080801486968994140625CLIENT_HANDSHAKE_TRAFFIC_SECRETCent" ascii 
      $x7 = "ssh: unexpected packet in response to channel open: %Ttls: certificate used with invalid signature algorithmtls: found unknown p" ascii 
      $x8 = "Caucasus Standard TimeClosing TCP connectionConvertSidToStringSidWConvertStringSidToSidWCreateEnvironmentBlockCreateIoCompletion" ascii 
      $x9 = "Belarus Standard TimeCentral Standard TimeCommand unrecognized.Eastern Standard TimeGSSAPI protocol errorGetProfilesDirectoryWIn" ascii 
      $x10 = "http: RoundTripper implementation (%T) returned a nil *Response with a nil errortls: either ServerName or InsecureSkipVerify mus" ascii 
      $x11 = "driver.ErrBadConn in checkBadConn. This should not happen.http2: client connection force closed via ClientConn.Closejson: cannot" ascii 
      $x12 = "Failed to send CommitXact with %vGODEBUG: no value specified for \"Sending NegotiateProtocol requestbad point length: %d, expect" ascii 
      $x13 = "lock: lock countslice bounds out of rangeslice of unsupported typesocket type not supportedssh: handshake failed: %vssh: padding" ascii 
      $x14 = "http2: Transport conn %p received error from processing frame %v: %vhttp2: Transport received unsolicited DATA frame; closing co" ascii 
      $x15 = "entersyscallexit status failoverportgcBitsArenasgcpacertracegetaddrinfowgot token %vhmac-sha1-96host is downhttp2debug=1http2deb" ascii 
      $x16 = "INSERTBULKINT2VECTORIP addressKEEP_NULLSKeep-AliveKharoshthiLockFileExManichaeanMessage-IdNo ContentOld_ItalicOld_PermicOld_Turk" ascii 
      $x17 = "[*]Not ExtendedNot ModifiedOPTS UTF8 ONPG_ATTRIBUTEPG_NODE_TREEPUSH_PROMISEPahawh_HmongRCodeRefusedRCodeSuccessREGNAMESPACEREGPR" ascii 
      $x18 = "streamSafe was not resetstructure needs cleaningtext/html; charset=utf-8unexpected ReadyForQueryunexpected buffer len=%vunknown " ascii 
      $x19 = "span set block with unpopped elements found in resetssh: peer's curve25519 public value has wrong lengthssh: unexpected message " ascii 
      $x20 = "file descriptor in bad statefindrunnable: netpoll with pfound pointer to free objectgcstopm: negative nmspinninggeneral SOCKS se" ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 30000KB and 3 of ($x*) 
}

rule FscanRule6 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 6"
   strings:
      $s1 = "PROT_EXEC|PROT_WRITE failed." fullword ascii 
      $s2 = "SZTZVZWZ2" fullword ascii 
      $s3 = "zODQxNDMxMjQz" fullword ascii 
      $s4 = " 6# $,\\6+ ," fullword ascii 
      $s5 = "templa" fullword ascii 
      $s6 = "I * HTTP/2.0" fullword ascii 
      $s7 = ">@ABCD" fullword ascii 
      $s8 = "prfaildmu" fullword ascii 
      $s9 = "i?master secretkey 6" fullword ascii 
      $s10 = "gethped2" fullword ascii 
      $s11 = "getL(og\"<" fullword ascii 
      $s12 = "~ 2!2\"2#2$2%2&2'2" fullword ascii 
      $s13 = "* O'RQ" fullword ascii 
      $s14 = "FtPh,NY" fullword ascii 
      $s15 = "fGet2r%" fullword ascii 
      $s16 = "myhostnaM9\"" fullword ascii 
      $s17 = "2!0-3&023" fullword ascii 
      $s18 = "(4 3%4'3\"" fullword ascii 
      $s19 = "%/41/2;-+-!4*" fullword ascii 
      $s20 = "xWORKLOG" fullword ascii 
   condition:
      uint16(0) == 0x457f and filesize < 20000KB and
      7 of them
}

rule FscanRule7 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 7"
   strings:
      $s1 = "RZSZTZVZW" fullword ascii 
      $s2 = "aGVycywgYW5" fullword ascii 
      $s3 = "e/processOp:ons7" fullword ascii 
      $s4 = "PROT_EXEC|PROT_WRITE failed." fullword ascii 
      $s5 = "OnRydWV9eb" fullword ascii 
      $s6 = "SRHR0cHM6Ly93" fullword ascii 
      $s7 = "=TT5uZnR0Ymhm" fullword ascii 
      $s8 = "UDUDUD" fullword ascii 
      $s9 = "master secretkey " fullword ascii 
      $s10 = "pqrst<" fullword ascii 
      $s11 = "L21qb2wvZXBk" fullword ascii 
      $s12 = "221222" ascii 
      $s13 = "3FCPRI * HTTP/2.0" fullword ascii 
      $s14 = "=>?@AB" fullword ascii 
      $s15 = "<$$$%%" fullword ascii 
      $s16 = "123456789ABCDEFtag:\"(" fullword ascii 
      $s17 = "\\2$1\\4$3." fullword ascii 
      $s18 = "Odum.AwY'j" fullword ascii 
      $s19 = "yaml.org,2" fullword ascii 
      $s20 = "ZZkt.agj" fullword ascii 
   condition:
      uint16(0) == 0x457f and filesize < 20000KB and
      8 of them
}

rule FscanRule8 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 8"
   strings:
      $s1 = "SZTZVZWZL" fullword ascii 
      $s2 = "XjEkfCxOE" fullword ascii 
      $s3 = "zODQxNDMxMjQz" fullword ascii 
      $s4 = "gethped" fullword ascii 
      $s5 = "templa" fullword ascii 
      $s6 = "prfaildmu" fullword ascii 
      $s7 = ".dllgq" fullword ascii 
      $s8 = "miNm.mmo" fullword ascii 
      $s9 = "dVyy:\\3" fullword ascii 
      $s10 = "\\4567\\." fullword ascii 
      $s11 = "FanX.PQX" fullword ascii 
      $s12 = "NTLMSSPH" fullword ascii 
      $s13 = "WSAGetOv" fullword ascii 
      $s14 = "*6:\"*\"F" fullword ascii 
      $s15 = "<2E2f@&`," fullword ascii 
      $s16 = "?2.16.840" fullword ascii 
      $s17 = "* B+xz" fullword ascii 
      $s18 = "~ ~'~(~,~-~/~3~6~" fullword ascii 
      $s19 = "4`6`7`8`$  " fullword ascii 
      $s20 = "\";476837" fullword ascii 
   condition:
      uint16(0) == 0x5a4d and filesize < 20000KB and  3 of them 
}

rule FscanRule9 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 9"
   strings:
      $s1 = "xyyyyzy" fullword ascii 
      $s2 = ";<<<<=" fullword ascii 
      $s3 = "uzesslkukey" fullword ascii 
      $s4 = "NSpq.GSsql.DBv" fullword ascii 
      $s5 = "* )N,,+8," fullword ascii 
      $s6 = "* A1Q:" fullword ascii 
      $s7 = "\"zftpgE;fkgc " fullword ascii 
      $s8 = "wChCeye" fullword ascii 
      $s9 = "41/2;-+-!4*" fullword ascii 
      $s10 = "ANCELCIRCLE$Q" fullword ascii 
      $s11 = "!%(+.~4!1" fullword ascii 
      $s12 = "),.2-b0,/\"0" fullword ascii 
      $s13 = "nAX* -" fullword ascii 
      $s14 = "|FtprK!#pjHu" fullword ascii 
      $s15 = "(,4 \"0 '$@" fullword ascii 
      $s16 = "bsostsxs" fullword ascii 
      $s17 = "qrsuxyy" fullword ascii 
      $s18 = "rissedrub" fullword ascii 
      $s19 = "nopquwz" fullword ascii 
      $s20 = "zpcderiv" fullword ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 20000KB and 4 of them 
}

rule FscanRule10 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 10"
   strings:
      $s1 = "aW5nQmxhZGU5c" fullword ascii 
      $s2 = "LjgzODQxNDM" fullword ascii 
      $s3 = "MGFiY2RlZ" fullword ascii 
      $s4 = "aGVycywgYW5m" fullword ascii 
      $s5 = "UDUDUD" fullword ascii 
      $s6 = "pqrst<" fullword ascii 
      $s7 = "templaLR" fullword ascii 
      $s8 = "RHR0cHM6Ly93" fullword ascii 
      $s9 = "221222" ascii 
      $s10 = "=>?@AB" fullword ascii 
      $s11 = "fprfaildmueat" fullword ascii 
      $s12 = "bsddll" fullword ascii 
      $s13 = " /y G)" fullword ascii 
      $s14 = "252D /267A " fullword ascii 
      $s15 = "$%&'()2!8@" fullword ascii 
      $s16 = "ftpgE;gc gj0m" fullword ascii 
      $s17 = "@>@5000@." fullword ascii 
      $s18 = "Q[SlogVm%" fullword ascii 
      $s19 = "$GrGet2k" fullword ascii 
      $s20 = "[ /s R" fullword ascii 
   condition:
      uint16(0) == 0x5a4d and filesize < 20000KB and 8 of them
}

rule FscanRule11 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 11"
   strings:
      $s1 = "processOp:ons7" fullword ascii 
      $s2 = "PROT_EXEC|PROT_WRITE failed." fullword ascii 
      $s3 = "   !!!" fullword ascii 
      $s4 = "U3ByaW5nQmxhZGU" fullword ascii 
      $s5 = "MGFiY2RlZ" fullword ascii 
      $s6 = "aGVycywgYk" fullword ascii 
      $s7 = "UDUDUD" fullword ascii 
      $s8 = "PQQQQR" fullword ascii 
      $s9 = "bCPRI * HTTP/2.0#B0" fullword ascii 
      $s10 = "100101" ascii 
      $s11 = "templaL" fullword ascii 
      $s12 = "=>?@AB" fullword ascii 
      $s13 = "Z3Vlc3Q6P0" fullword ascii 
      $s14 = "\\.+2267_" fullword ascii 
      $s15 = "TueURIUTCVaiViaWedX:\"LX" fullword ascii 
      $s16 = "gethped8" fullword ascii 
      $s17 = " method:\"S" fullword ascii 
      $s18 = "O:\\yyyyd" fullword ascii 
      $s19 = "cretkey " fullword ascii 
      $s20 = "* LJD5LY" fullword ascii 
   condition:
      uint16(0) == 0x457f and filesize < 20000KB and
      8 of them
}

rule FscanRule12 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 12"
   strings:
      $s1 = "mTmVmWmZm" fullword ascii 
      $s2 = "templa" fullword ascii 
      $s3 = "yOip 2%S%oli" fullword ascii 
      $s4 = "\\5667\\." fullword ascii 
      $s5 = " (/7=E44." fullword ascii 
      $s6 = "~ ~'~(~,~-~/~3~6~" fullword ascii 
      $s7 = "lspyc.y" fullword ascii 
      $s8 = "* V-X<K" fullword ascii 
      $s9 = " $}3-4-3+e" fullword ascii 
      $s10 = "6F%}^6e\"" fullword ascii 
      $s11 = "2!0-3&023" fullword ascii 
      $s12 = "WSAGetOvY" fullword ascii 
      $s13 = "(BP - " fullword ascii 
      $s14 = "nIRC2n%+I" fullword ascii 
      $s15 = " 2!2\"2#2$2%2&2'2" fullword ascii 
      $s16 = "kernel32Il" fullword ascii 
      $s17 = "_\")2^2({" fullword ascii 
      $s18 = "41/2;-+-!4*" fullword ascii 
      $s19 = "[/\\2222]^_`(" fullword ascii 
      $s20 = ".IJm2g vZhIrCH" fullword ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 20000KB and 7 of them
}

rule FscanRule13 {
   meta:
      description = "Detect the risk of Malware Fscan Rule 13"
   strings:
      $s1 = "cdefgi" fullword ascii 
      $s2 = "aGVycywgYW5" fullword ascii 
      $s3 = " YXNzd2Q=" fullword ascii 
      $s4 = "=TT5uZnR0YmhmL21qb2wvZXB" fullword ascii 
      $s5 = "sckddll" fullword ascii 
      $s6 = "gethped" fullword ascii 
      $s7 = "#yKey1keye\\s" fullword ascii 
      $s8 = "100101" ascii 
      $s9 = "templaL" fullword ascii 
      $s10 = "prfaildmu" fullword ascii 
      $s11 = "ddllnv" fullword ascii 
      $s12 = "KHrp:\"" fullword ascii 
      $s13 = "\\rr* -" fullword ascii 
      $s14 = "HPINGPEPLUSPORTSR" fullword ascii 
      $s15 = "Al.CmWftp.Ns" fullword ascii 
      $s16 = "'\"7\"C\"" fullword ascii 
      $s17 = "\"bGet2`,&Dtcx" fullword ascii 
      $s18 = "seuevexeyeze{e|e}e~e" fullword ascii 
      $s19 = "getL^OR" fullword ascii 
      $s20 = "####4?7;####%)" fullword ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 20000KB and 7 of them
}

rule FscanRule14{
   meta:
      description = "Detect the risk of Malware Fscan Rule 14"
   strings:
      $s1 = "eempndnpy" fullword ascii 
      $s2 = "fedcba" ascii 
      $s3 = "aGVycywgYW5" fullword ascii 
      $s4 = " YXNzd2Q=" fullword ascii 
      $s5 = "0YmhmL21qb2wvZXBk" fullword ascii 
      $s6 = "ZDUiOnRydWV9e" fullword ascii 
      $s7 = "UDUDUD" fullword ascii 
      $s8 = "cm9vdDpyb" fullword ascii 
      $s9 = "irunbcd" fullword ascii 
      $s10 = "4,-./0" fullword ascii 
      $s11 = "IQtY:\\\\" fullword ascii 
      $s12 = "\\2345\\." fullword ascii 
      $s13 = "bsddll" fullword ascii 
      $s14 = "NTLMDSS" fullword ascii 
      $s15 = ",getL0og" fullword ascii 
      $s16 = "%\"(5;-1," fullword ascii 
      $s17 = "\";476837" fullword ascii 
      $s18 = "Slogj+!" fullword ascii 
      $s19 = "2!0-3&023" fullword ascii 
      $s20 = ",[$2222 (" fullword ascii 

   condition:
      uint16(0) == 0x5a4d and filesize < 14000KB and 8 of them
}

rule FscanRule15{
   meta:
      description = "Detect the risk of Malware Fscan Rule 15"
   strings:
      $s1 = "onmlkji" fullword ascii 
      $s2 = "LjgzODQxNDM" fullword ascii 
      $s3 = "MGFiY2RlZ" fullword ascii 
      $s4 = "XjEkfCxOE" fullword ascii 
      $s5 = "YXBhY2hlL" fullword ascii 
      $s6 = "aGVycywgYW5m" fullword ascii 
      $s7 = "circrsy" fullword ascii 
      $s8 = "RHR0cHM6Ly93" fullword ascii 
      $s9 = "bE0kNSMAE" fullword ascii
      $s10 = "fsieye" fullword ascii 
      $s11 = "ECSHSfFHRSHSE.SUb" fullword ascii 
      $s12 = "HV -v >O" fullword ascii 
      $s13 = "B.CmWftp." fullword ascii 
      $s14 = "'57.4;2\\-" fullword ascii 
      $s15 = "seuevexeyeze{e|e}e~e" fullword ascii 
      $s16 = ",h1,p=,r=- -j" fullword ascii 
      $s17 = "2!0-3&023" fullword ascii 
      $s18 = "* m\\9P" fullword ascii 
      $s19 = ".g4CIRCLEDj" fullword ascii 
      $s20 = "* ::}A" fullword ascii 
   condition:
      uint16(0) == 0x5a4d and filesize < 14000KB and 8 of them
}

private rule cobaltstrike_template_exe
{
    strings:
        $compiler = "mingw-w64 runtime failure" nocase

        $f1 = "VirtualQuery"   fullword
        $f2 = "VirtualProtect" fullword
        $f3 = "vfprintf"       fullword
        $f4 = "Sleep"          fullword
        $f5 = "GetTickCount"   fullword

        $c1 = { // Compare case insensitive with "msvcrt", char by char
                0f b6 50 01 80 fa 53 74 05 80 fa 73 75 42 0f b6
                50 02 80 fa 56 74 05 80 fa 76 75 34 0f b6 50 03
                80 fa 43 74 05 80 fa 63 75 26 0f b6 50 04 80 fa
                52 74 05 80 fa 72 75 18 0f b6 50 05 80 fa 54 74
        }
    condition:
        uint16(0) == 0x5a4d and
        filesize < 1000KB and
        $compiler and
        all of ($f*) and
        all of ($c*)
}    



rule hacktool_windows_cobaltstrike_artifact_exe
{
    meta:
         description = "Detect the risk of  Malware Cobalt Strike Rule 1"
    condition:
        cobaltstrike_template_exe and
        filesize < 100KB and
        pe.sections[pe.section_index(".data")].raw_data_size > 512 and
        math.entropy(pe.sections[pe.section_index(".data")].raw_data_offset, 512 ) >= 7
}

private rule cobaltstrike_beacon_raw
{
    strings:
        $s1 = "%d is an x64 process (can't inject x86 content)" fullword
        $s2 = "Failed to impersonate logged on user %d (%u)" fullword
        $s3 = "powershell -nop -exec bypass -EncodedCommand \"%s\"" fullword
        $s4 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s" fullword
        $s5 = "could not run command (w/ token) because of its length of %d bytes!" fullword
        $s6 = "could not write to process memory: %d" fullword
        $s7 = "%s.4%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%08x%08x%08x%08x%08x%08x%08x.%x%x.%s" fullword
        $s8 = "Could not connect to pipe (%s): %d" fullword

        $b1 = "beacon.dll"     fullword
        $b2 = "beacon.x86.dll" fullword
        $b3 = "beacon.x64.dll" fullword

    condition:
        uint16(0) == 0x5a4d and
        filesize < 1000KB and
        (
            any of ($b*) or
            5 of ($s*)
        )
}

private rule cobaltstrike_beacon_exe
{
    condition:
        cobaltstrike_template_exe and
        filesize > 100KB and filesize < 500KB and
        pe.sections[pe.section_index(".data")].raw_data_size > 200000 and
        math.entropy(pe.sections[pe.section_index(".data")].raw_data_offset + 1024, 150000 ) >= 7 
}

private rule cobaltstrike_beacon_b64
{
    strings:
        $s1a = "JWQgaXMgYW4geDY0IHByb2Nlc3MgKGNhbid0IGluam"
        $s1b = "ZCBpcyBhbiB4NjQgcHJvY2VzcyAoY2FuJ3QgaW5qZW"
        $s1c = "IGlzIGFuIHg2NCBwcm9jZXNzIChjYW4ndCBpbmplY3"

        $s2a = "RmFpbGVkIHRvIGltcGVyc29uYXRlIGxvZ2dlZCBvbi"
        $s2b = "YWlsZWQgdG8gaW1wZXJzb25hdGUgbG9nZ2VkIG9uIH"
        $s2c = "aWxlZCB0byBpbXBlcnNvbmF0ZSBsb2dnZWQgb24gdX"

        $s3a = "cG93ZXJzaGVsbCAtbm9wIC1leGVjIGJ5cGFzcyAtRW"
        $s3b = "b3dlcnNoZWxsIC1ub3AgLWV4ZWMgYnlwYXNzIC1Fbm"
        $s3c = "d2Vyc2hlbGwgLW5vcCAtZXhlYyBieXBhc3MgLUVuY2"

        $s4a = "SUVYIChOZXctT2JqZWN0IE5ldC5XZWJjbGllbnQpLk"
        $s4b = "RVggKE5ldy1PYmplY3QgTmV0LldlYmNsaWVudCkuRG"
        $s4c = "WCAoTmV3LU9iamVjdCBOZXQuV2ViY2xpZW50KS5Eb3"

    condition:
        filesize < 1000KB and
        5 of ($s*)
}

rule hacktool_windows_cobaltstrike_beacon
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 2"
    condition:
        cobaltstrike_beacon_b64 or
        cobaltstrike_beacon_raw or
        cobaltstrike_beacon_exe
}

rule hacktool_windows_cobaltstrike_postexploitation
{
    meta:
       description = "Detect the risk of  Malware Cobalt Strike Rule 3"
    strings:
        $s1 = "\\devcenter\\aggressor\\external\\"

    condition:
        filesize > 10KB and filesize < 1000KB and
        all of ($s*)
}

rule hacktool_windows_cobaltstrike_powershell
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 4"
    strings:
        $ps1 = "Set-StrictMode -Version 2"
        $ps2 = "func_get_proc_address"
        $ps3 = "func_get_delegate_type"
        $ps4 = "FromBase64String"
        $ps5 = "VirtualAlloc"
        $ps6 = "var_code"
        $ps7 = "var_buffer"
        $ps8 = "var_hthread"

    condition:
        $ps1 at 0 and
        filesize < 1000KB and
        7 of ($ps*)
}

rule beacon32
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 5"
    strings:
        $name = "%c%c%c%c%c%c%c%c%cMSSE-%d-server"
    condition:
        uint16(0) == 0x5A4D and pe.entry_point == 0x8b0 and filesize > 277KB and filesize < 304KB and $name
}


rule ps
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 6"
    strings:
        $str1 = "$var_va.Invoke([IntPtr]::Zero, $var_code.Length, 0x3000, 0x40)"
        $str2 = "[System.Runtime.InteropServices.Marshal]::Copy($var_code, 0, $var_buffer, $var_code.length)"
    condition:
       uint16(0) != 0x5A4D and $str1 and $str2
}

rule CobaltStrike_hta_pe
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 7"
    strings:
        $reg1 = /var_tempexe = var_basedir & \"\\\" & \"[A-z]{1,20}.exe\"\s*Set var_stream = var_obj.CreateTextFile\(var_tempexe, true , false\)/
    condition:
       uint16(0) != 0x5A4D and  $reg1
}

rule hta_VBS
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 8"
    strings:
        $str = "myAr\"&\"ray \"&Chr(61)&\" Array\"&Chr(40)&Chr(45)&\"4\"&Chr(44)&Chr(45)&\"24\"&Chr(44)&Chr(45)&\"119\"&Chr(44)"
    condition:
       uint16(0) != 0x5A4D and  $str
}


rule hta_ps1
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 9"
    strings:
        $str = "var_shell.run \"powershell -nop -w hidden -encodedcommand JABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8A"
    condition:
       uint16(0) != 0x5A4D and  $str
}

rule hacktool_windows_cobaltstrike_powershell_2
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 10"
    strings:
        $ps1 = "'System.dll'" ascii
        $ps2 = "Set-StrictMode -Version 2" ascii
        $ps3 = "GetProcAddress" ascii
        $ps4 = "start-job" ascii
        $ps5 = "VirtualAlloc" ascii
    condition:
        $ps2 at 0 and
        filesize < 1000KB and
        all of ($ps*)
}

rule hacktool_windows_cobaltstrike_in_memory
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 11"
    strings:
        $s1 = "IEX (New-Object Net.Webclient).DownloadString('http://127.0.0.1:%u/'); %s"
        $s2 = "powershell -nop -exec bypass -EncodedCommand \"%s\""
        $s3 = "%d is an x86 process (can't inject x64 content)"
        $s4 = "%d.%d    %s  %s  %s  %s"
        $s5 = "could not upload file: %d"
        $s7 = "KVK...................................0.-.n"
        $s8 = "%d is an x64 process (can't inject x86 content)"
        $op1 = {C7 45 F0 0? 00 00 00 E9 BF A3 BC FF}
    condition:
        6 of them
}

rule cobaltstrike_beacon_in_memory
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 12"
    strings:
        $s1 = "beacon.x64.dll" fullword
        $s2 = "F    %I64d   %02d/%02d/%02d %02d:%02d:%02d   %s" fullword
    condition:
        all of them
}

rule APT_CobaltStrike_Beacon_Indicator {
   meta:
      description = "Detect the risk of  Malware Cobalt Strike Rule 13"
   strings:
      $v1 = { 73 70 72 6E 67 00 }
      $v2 = { 69 69 69 69 69 69 69 69 }
   condition:
      uint16(0) == 0x5a4d and filesize < 300KB and all of them
}
rule CobaltStrike_ShellCode
{
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 14"
    strings:
        $ = {8B 58 24 01 D3 66 8B 0C 4B 8B 58 1C 01 D3 8B 04 8B}
        $ = {68 6E 65 74 00 68 77 69 6E 69 54 68 4C 77 26 07 FF D5}
    condition:
        any of them
}

rule CobaltStrike_Payload
{
    meta:
        description ="Detect the risk of  Malware Cobalt Strike Rule 15"
    strings:
        $ = "%c%c%c%c%c%c%c%c%cMSSE-%d-server" fullword ascii
        $ = {B9 AA 26 00 00 31 D2 C7 44 24 28 5C 00 00 00 C7 44 24 24 65 00 00 00 C7 44 24 20 70 00 00 00 C7 44 24 1C 69 00 00 00 C7 44 24 18 70 00 00 00 F7 F1 C7 44 24 14 5C 00 00 00 C7 44 24 10 2E 00 00 00 C7 44 24 0C 5C 00 00 00 C7 44 24 08 5C 00 00 00 C7 44 24 04 44 40 40 00 C7 04 24 F0 53 40 00 89 54 24}
    condition:
        any of them
}

rule CobaltStrike_Malicious_HTA {
   meta:
      description = "Detect the risk of  Malware Cobalt Strike Rule 16"
   strings:
      $var_shell = "CreateObject(\"Wscript.Shell\")" nocase
      $RunPowerShell = "powershell -nop -w hidden -encodedcommand " nocase
      $DropFile = ".Write Chr(CLng(\"&H\" & Mid(" nocase
      $Obfuscator = "&\"Long\"&Chr(44)&" nocase
      $Script = "<script language=\"vbscript\">" nocase
   condition:
      $var_shell and $Script and 3 of them
}

rule CobaltStrike_imphashes {
   meta:
      description ="Detect the risk of  Malware Cobalt Strike Rule 17"
   condition:
      pe.imphash() == "829da329ce140d873b4a8bde2cbfaa7e" or pe.imphash() == "dc25ee78e2ef4d36faa0badf1e7461c9"
}

rule Cobaltbaltstrike_RAW_Payload_dns_stager_x86
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 18"
  strings:
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    uint32(@h01+0x00a3) == 0xe553a458 and
    uint32(@h01+0x00bd) == 0x0726774c and
    uint32(@h01+0x012f) == 0xc99cc96a and
    uint32(@h01+0x0198) == 0x56a2b5f0 and
    uint32(@h01+0x01a4) == 0xe035f044 and
    uint32(@h01+0x01e4) == 0xcc8e00f4
}

rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 19"
  strings:
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    uint32(@h01+0x00a1) == 0xe553a458 and
    uint32(@h01+0x00c4) == 0xd4df7045 and
    uint32(@h01+0x00d2) == 0xe27d6f28 and
    uint32(@h01+0x00f8) == 0xbb5f9ead and
    uint32(@h01+0x010d) == 0xbb5f9ead and
    uint32(@h01+0x0131) == 0xfcddfac0 and
    uint32(@h01+0x0139) == 0x528796c6 and
    uint32(@h01+0x014b) == 0x56a2b5f0
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 20"
  strings:
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00ac) == 0x006b8029 and
    uint32(@h01+0x00bb) == 0xe0df0fea and
    uint32(@h01+0x00d5) == 0x6737dbc2 and
    uint32(@h01+0x00de) == 0xff38e9b7 and
    uint32(@h01+0x00e8) == 0xe13bec74 and
    uint32(@h01+0x00f1) == 0x614d6e75 and
    uint32(@h01+0x00fa) == 0x56a2b5f0 and
    uint32(@h01+0x0107) == 0x5fc8d902 and
    uint32(@h01+0x011a) == 0xe553a458 and
    uint32(@h01+0x0128) == 0x5fc8d902 and
    uint32(@h01+0x013d) == 0x614d6e75
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 21"
  strings:
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    uint32(@h01+0x0100) == 0x0726774c and
    uint32(@h01+0x0111) == 0x006b8029 and
    uint32(@h01+0x012d) == 0xe0df0fea and
    uint32(@h01+0x0142) == 0x6737dbc2 and
    uint32(@h01+0x0150) == 0xff38e9b7 and
    uint32(@h01+0x0161) == 0xe13bec74 and
    uint32(@h01+0x016f) == 0x614d6e75 and
    uint32(@h01+0x0198) == 0x5fc8d902 and
    uint32(@h01+0x01b8) == 0xe553a458 and
    uint32(@h01+0x01d2) == 0x5fc8d902 and
    uint32(@h01+0x01ee) == 0x614d6e75
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 22"
  strings:
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00ac) == 0x006b8029 and
    uint32(@h01+0x00bb) == 0xe0df0fea and
    uint32(@h01+0x00d5) == 0x6174a599 and
    uint32(@h01+0x00e5) == 0x56a2b5f0 and
    uint32(@h01+0x00f2) == 0x5fc8d902 and
    uint32(@h01+0x0105) == 0xe553a458 and
    uint32(@h01+0x0113) == 0x5fc8d902
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 23"
  strings:
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    uint32(@h01+0x0100) == 0x0726774c and
    uint32(@h01+0x0111) == 0x006b8029 and
    uint32(@h01+0x012d) == 0xe0df0fea and
    uint32(@h01+0x0142) == 0x6174a599 and
    uint32(@h01+0x016b) == 0x5fc8d902 and
    uint32(@h01+0x018b) == 0xe553a458 and
    uint32(@h01+0x01a5) == 0x5fc8d902 and
    uint32(@h01+0x01c1) == 0x614d6e75
}

rule Cobaltbaltstrike_RAW_Payload_http_stager_x86
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 24"
  strings:
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00aa) == 0xa779563a and
    uint32(@h01+0x00c6) == 0xc69f8957 and
    uint32(@h01+0x00de) == 0x3b2e55eb and
    uint32(@h01+0x00f2) == 0x7b18062d and
    uint32(@h01+0x010b) == 0x5de2c5aa and
    uint32(@h01+0x0114) == 0x315e2145 and
    uint32(@h01+0x0123) == 0x0be057b7 and
    uint32(@h01+0x02c4) == 0x56a2b5f0 and
    uint32(@h01+0x02d8) == 0xe553a458 and
    uint32(@h01+0x02f3) == 0xe2899612
}

rule Cobaltbaltstrike_RAW_Payload_http_stager_x64
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 25"
  strings:
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    uint32(@h01+0x00e9) == 0x0726774c and
    uint32(@h01+0x0101) == 0xa779563a and
    uint32(@h01+0x0120) == 0xc69f8957 and
    uint32(@h01+0x013f) == 0x3b2e55eb and
    uint32(@h01+0x0163) == 0x7b18062d and
    uint32(@h01+0x0308) == 0x56a2b5f0 and
    uint32(@h01+0x0324) == 0xe553a458 and
    uint32(@h01+0x0342) == 0xe2899612
}


rule Cobaltbaltstrike_RAW_Payload_https_stager_x86
{
  meta:
    description ="Detect the risk of  Malware Cobalt Strike Rule 26"
  strings:
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00af) == 0xa779563a and
    uint32(@h01+0x00cb) == 0xc69f8957 and
    uint32(@h01+0x00e7) == 0x3b2e55eb and
    uint32(@h01+0x0100) == 0x869e4675 and
    uint32(@h01+0x0110) == 0x7b18062d and
    uint32(@h01+0x0129) == 0x5de2c5aa and
    uint32(@h01+0x0132) == 0x315e2145 and
    uint32(@h01+0x0141) == 0x0be057b7 and
    uint32(@h01+0x02e9) == 0x56a2b5f0 and
    uint32(@h01+0x02fd) == 0xe553a458 and
    uint32(@h01+0x0318) == 0xe2899612
}


rule Cobaltbaltstrike_RAW_Payload_https_stager_x64
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 27"
  strings:
    $h01 = { FC 48 83 E4 F0 E8 C8 00 00 00 41 51 41 50 52 51 56 48 31 D2 65 48 8B 52 }
  condition:
    uint32(@h01+0x00e9) == 0x0726774c and
    uint32(@h01+0x0101) == 0xa779563a and
    uint32(@h01+0x0123) == 0xc69f8957 and
    uint32(@h01+0x0142) == 0x3b2e55eb and
    uint32(@h01+0x016c) == 0x869e4675 and
    uint32(@h01+0x0186) == 0x7b18062d and
    uint32(@h01+0x032b) == 0x56a2b5f0 and
    uint32(@h01+0x0347) == 0xe553a458 and
    uint32(@h01+0x0365) == 0xe2899612
}

rule Cobaltbaltstrike_RAW_Payload_dns_stager_x86_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 28"
  strings:
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x0149) == 0xe5005300 and
    uint32(@h01+0x017d) == 0x07002600 and
    uint32(@h01+0x0261) == 0xc9009c00 and
    uint32(@h01+0x0333) == 0x5600a200 and
    uint32(@h01+0x034b) == 0xe0003500 and
    uint32(@h01+0x03cb) == 0xcc008e00
}

rule Cobaltbaltstrike_RAW_Payload_smb_stager_x86_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 29"
  strings:
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x0145) == 0xe5005300 and
    uint32(@h01+0x018b) == 0xd400df00 and
    uint32(@h01+0x01a7) == 0xe2007d00 and
    uint32(@h01+0x01f3) == 0xbb005f00 and
    uint32(@h01+0x021d) == 0xbb005f00 and
    uint32(@h01+0x0265) == 0xfc00dd00 and
    uint32(@h01+0x0275) == 0x52008700 and
    uint32(@h01+0x0299) == 0x5600a200
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x86_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 30"
  strings:
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x015b) == 0x00006b00 and
    uint32(@h01+0x0179) == 0xe000df00 and
    uint32(@h01+0x01ad) == 0x67003700 and
    uint32(@h01+0x01bf) == 0xff003800 and
    uint32(@h01+0x01d3) == 0xe1003b00 and
    uint32(@h01+0x01e5) == 0x61004d00 and
    uint32(@h01+0x01f7) == 0x5600a200 and
    uint32(@h01+0x0211) == 0x5f00c800 and
    uint32(@h01+0x0237) == 0xe5005300 and
    uint32(@h01+0x0253) == 0x5f00c800 and
    uint32(@h01+0x027d) == 0x61004d00
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Bind_x64_UTF16
{
  meta:
    description ="Detect the risk of  Malware Cobalt Strike Rule 31"
  strings:
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
  condition:
    uint32(@h01+0x0203) == 0x07002600 and
    uint32(@h01+0x0225) == 0x00006b00 and
    uint32(@h01+0x025d) == 0xe000df00 and
    uint32(@h01+0x0287) == 0x67003700 and
    uint32(@h01+0x02a3) == 0xff003800 and
    uint32(@h01+0x02c5) == 0xe1003b00 and
    uint32(@h01+0x02e1) == 0x61004d00 and
    uint32(@h01+0x0333) == 0x5f00c800 and
    uint32(@h01+0x0373) == 0xe5005300 and
    uint32(@h01+0x03a7) == 0x5f00c800 and
    uint32(@h01+0x03df) == 0x61004d00
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x86_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 32"
  strings:
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x015b) == 0x00006b00 and
    uint32(@h01+0x0179) == 0xe000df00 and
    uint32(@h01+0x01ad) == 0x61007400 and
    uint32(@h01+0x01cd) == 0x5600a200 and
    uint32(@h01+0x01e7) == 0x5f00c800 and
    uint32(@h01+0x020d) == 0xe5005300 and
    uint32(@h01+0x0229) == 0x5f00c800
}

rule Cobaltbaltstrike_RAW_Payload_TCP_Reverse_x64_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 33"
  strings:
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
  condition:
    uint32(@h01+0x0203) == 0x07002600 and
    uint32(@h01+0x0225) == 0x00006b00 and
    uint32(@h01+0x025d) == 0xe000df00 and
    uint32(@h01+0x0287) == 0x61007400 and
    uint32(@h01+0x02d9) == 0x5f00c800 and
    uint32(@h01+0x0319) == 0xe5005300 and
    uint32(@h01+0x034d) == 0x5f00c800 and
    uint32(@h01+0x0385) == 0x61004d00
}

rule Cobaltbaltstrike_RAW_Payload_http_stager_x86_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 34"
  strings:
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x0157) == 0xa7007900 and
    uint32(@h01+0x018f) == 0xc6009f00 and
    uint32(@h01+0x01bf) == 0x3b002e00 and
    uint32(@h01+0x01e7) == 0x7b001800 and
    uint32(@h01+0x0219) == 0x5d00e200 and
    uint32(@h01+0x022b) == 0x31005e00 and
    uint32(@h01+0x0249) == 0x0b00e000 and
    uint32(@h01+0x058b) == 0x5600a200 and
    uint32(@h01+0x05b3) == 0xe5005300 and
    uint32(@h01+0x05e9) == 0xe2008900
}

rule Cobaltbaltstrike_RAW_Payload_http_stager_x64_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 35"
  strings:
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
  condition:
    uint32(@h01+0x01d5) == 0x07002600 and
    uint32(@h01+0x0205) == 0xa7007900 and
    uint32(@h01+0x0243) == 0xc6009f00 and
    uint32(@h01+0x0281) == 0x3b002e00 and
    uint32(@h01+0x02c9) == 0x7b001800 and
    uint32(@h01+0x0613) == 0x5600a200 and
    uint32(@h01+0x064b) == 0xe5005300 and
    uint32(@h01+0x0687) == 0xe2008900
}

rule Cobaltbaltstrike_RAW_Payload_https_stager_x86_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 36"
  strings:
    $h01 = { FC 00 E8 00 89 00 00 00 00 00 00 00 60 00 89 00 E5 00 31 00 D2 00 64 00 8B 00 52 00 30 00 8B 00 52 00 0C 00 8B 00 52 00 14 00 8B 00 72 00 28 }
  condition:
    uint32(@h01+0x013b) == 0x07002600 and
    uint32(@h01+0x0161) == 0xa7007900 and
    uint32(@h01+0x0199) == 0xc6009f00 and
    uint32(@h01+0x01d1) == 0x3b002e00 and
    uint32(@h01+0x0203) == 0x86009e00 and
    uint32(@h01+0x0223) == 0x7b001800 and
    uint32(@h01+0x0255) == 0x5d00e200 and
    uint32(@h01+0x0267) == 0x31005e00 and
    uint32(@h01+0x0285) == 0x0b00e000 and
    uint32(@h01+0x05d5) == 0x5600a200 and
    uint32(@h01+0x05fd) == 0xe5005300 and
    uint32(@h01+0x0633) == 0xe2008900
}

rule Cobaltbaltstrike_RAW_Payload_https_stager_x64_UTF16
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 37"
  strings:
    $h01 = { FC 00 48 00 83 00 E4 00 F0 00 E8 00 C8 00 00 00 00 00 00 00 41 00 51 00 41 00 50 00 52 00 51 00 56 00 48 00 31 00 D2 00 65 00 48 00 8B 00 52 }
  condition:
    uint32(@h01+0x01d5) == 0x07002600 and
    uint32(@h01+0x0205) == 0xa7007900 and
    uint32(@h01+0x0249) == 0xc6009f00 and
    uint32(@h01+0x0287) == 0x3b002e00 and
    uint32(@h01+0x02db) == 0x86009e00 and
    uint32(@h01+0x030f) == 0x7b001800 and
    uint32(@h01+0x0659) == 0x5600a200 and
    uint32(@h01+0x0691) == 0xe5005300 and
    uint32(@h01+0x06cd) == 0xe2008900
}

rule Cobaltbaltstrike_Payload_Encoded
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 38"
  strings:
    $s01 = "0xfc, 0xe8, 0x89, 0x00, 0x00, 0x00, 0x60, 0x89, 0xe5, 0x31, 0xd2, 0x64, 0x8b, 0x52, 0x30, 0x8b" ascii wide nocase
    $s02 = "0xfc,0xe8,0x89,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xd2,0x64,0x8b,0x52,0x30,0x8b" ascii wide nocase
    $s03 = "0xfc, 0x48, 0x83, 0xe4, 0xf0, 0xe8, 0xc8, 0x00, 0x00, 0x00, 0x41, 0x51, 0x41, 0x50, 0x52, 0x51" ascii wide nocase
    $s04 = "0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc8,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,0x51" ascii wide nocase
    $s05 = "fce8890000006089e531d2648b52308b" ascii wide nocase
    $s06 = "fc e8 89 00 00 00 60 89 e5 31 d2 64 8b 52 30 8b" ascii wide nocase
    $s07 = "fc4883e4f0e8c8000000415141505251" ascii wide nocase
    $s08 = "fc 48 83 e4 f0 e8 c8 00 00 00 41 51 41 50 52 51" ascii wide nocase
    $s09 = "/OiJAAAAYInlMdJki1Iwi1IMi1IUi3IoD7dKJjH/McCsPGF8Aiwgwc8NAcfi8FJX" ascii wide
    $s10 = "/EiD5PDoyAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHA" ascii wide
    $s11 = "38uqIyMjQ6rGEvFHqHETqHEvqHE3qFELLJRpBRLcEuOPH0JfIQ8D4uwuIuTB03F0" ascii wide
    $s12 = "32ugx9PL6yMjI2JyYnNxcnVrEvFGa6hxQ2uocTtrqHEDa6hRc2sslGlpbhLqaxLj" ascii wide
    $s13 = "/ADoAIkAAAAAAAAAYACJAOUAMQDSAGQAiwBSADAAiwBSAAwAiwBSABQAiwByACg" ascii wide
    $s14 = "/ABIAIMA5ADwAOgAyAAAAAAAAABBAFEAQQBQAFIAUQBWAEgAMQDSAGUASACLAFI" ascii wide
    $s15 = "3yPLI6ojIyMjIyMjQyOqI8YjEiPxI0cjqCNxIxMjqCNxIy8jqCNxIzcjqCNRIwsj" ascii wide
    $s16 = "3yNrI6AjxyPTI8sj6yMjIyMjIyNiI3IjYiNzI3EjciN1I2sjEiPxI0YjayOoI3Ej" ascii wide
    $s17 = "Array(-4,-24,-119,0,0,0,96,-119,-27,49,-46,100,-117,82,48,-117" ascii wide
    $s18 = "Array(-4, -24, -119, 0, 0, 0, 96, -119, -27, 49, -46, 100, -117, 82, 48, -117" ascii wide
    $s19 = "Array(-4,72,-125,-28,-16,-24,-56,0,0,0,65,81,65,80,82,81" ascii wide
    $s20 = "Array(-4, 72, -125, -28, -16, -24, -56, 0, 0, 0, 65, 81, 65, 80, 82, 81" ascii wide
    $s21 = "Chr(-4)&Chr(-24)&Chr(-119)&Chr(0)&Chr(0)&Chr(0)&Chr(96)&Chr(-119)&Chr(-27)&\"1\"&Chr(-46)&\"d\"&Chr(-117)&\"R0\"&Chr(-117)" ascii wide
    $s22 = "Chr(-4)&\"H\"&Chr(-125)&Chr(-28)&Chr(-16)&Chr(-24)&Chr(-56)&Chr(0)&Chr(0)&Chr(0)&\"AQAPRQVH" ascii wide
    $s23 = "\\xfc\\xe8\\x89\\x00\\x00\\x00\\x60\\x89\\xe5\\x31\\xd2\\x64\\x8b\\x52\\x30\\x8b" ascii wide nocase
    $s24 = "\\xfc\\x48\\x83\\xe4\\xf0\\xe8\\xc8\\x00\\x00\\x00\\x41\\x51\\x41\\x50\\x52\\x51" ascii wide nocase

  condition:
        any of them
}

rule Cobaltbaltstrike_strike_Payload_XORed
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 39"
  strings:
    $h01 = { 10 ?? 00 00 ?? ?? ?? 00 ?? ?? ?? ?? 61 61 61 61 }
  condition:
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0xFCE88900 or
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0xFC4883E4 or
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x4D5AE800 or
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x4D5A4152 or
    uint32be(@h01+8) ^ uint32be(@h01+16) == 0x90909090
}

rule Cobaltbaltstrike_Beacon_x86
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 40"
  strings:
    $h01 = { 4D 5A E8 00 00 00 00 5B 89 DF 52 45 55 89 E5 81 C3 ?? ?? ?? ?? FF D3 68 }
    $h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
    $h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
    $h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
  condition:
    $h01 and
    any of ($h1*)
}

rule Cobaltbaltstrike_Beacon_x64
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 41"
  strings:
    $h01 = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D EA FF FF FF 48 89 }
    $h11 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 }
    $h12 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 }
    $h13 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E }
  condition:
    $h01 and
    any of ($h1*)
}

rule Cobaltbaltstrike_Beacon_Encoded
{
  meta:
    description ="Detect the risk of  Malware Cobalt Strike Rule 42"
  strings:
    $s01 = "0x4d, 0x5a, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x5b, 0x89, 0xdf, 0x52, 0x45, 0x55, 0x89, 0xe5, 0x81" ascii wide nocase
    $s02 = "0x4d,0x5a,0xe8,0x00,0x00,0x00,0x00,0x5b,0x89,0xdf,0x52,0x45,0x55,0x89,0xe5,0x81" ascii wide nocase
    $s03 = "0x4d, 0x5a, 0x41, 0x52, 0x55, 0x48, 0x89, 0xe5, 0x48, 0x81, 0xec, 0x20, 0x00, 0x00, 0x00, 0x48" ascii wide nocase
    $s04 = "0x4d,0x5a,0x41,0x52,0x55,0x48,0x89,0xe5,0x48,0x81,0xec,0x20,0x00,0x00,0x00,0x48" ascii wide nocase
    $s05 = "4d5ae8000000005b89df52455589e581" ascii wide nocase
    $s06 = "4d 5a e8 00 00 00 00 5b 89 df 52 45 55 89 e5 81" ascii wide nocase
    $s07 = "4d5a4152554889e54881ec2000000048" ascii wide nocase
    $s08 = "4d 5a 41 52 55 48 89 e5 48 81 ec 20 00 00 00 48" ascii wide nocase
    $s09 = "TVroAAAAAFuJ31JFVYnlg" ascii wide
    $s10 = "TVpBUlVIieVIgewgAAAAS" ascii wide
    $s11 = "bnnLIyMjI3iq/HFmdqrGo" ascii wide
    $s12 = "bnlicXZrqsZros8DIyMja" ascii wide
    $s13 = "TQBaAOgAAAAAAAAAAABbAIkA3wBSAEUAVQCJAOUAg" ascii wide
    $s14 = "TQBaAEEAUgBVAEgAiQDlAEgAgQDsACAAAAAAAAAAS" ascii wide
    $s15 = "biN5I2IjcSN2I2sjqiPGI2sjoiPPIwMjIyMjIyMja" ascii wide
    $s16 = "biN5I8sjIyMjIyMjIyN4I6oj/CNxI2YjdiOqI8Yjo" ascii wide
    $s17 = "Array(77,90,-24,0,0,0,0,91,-119,-33,82,69,85,-119,-27,-127" ascii wide
    $s18 = "Array(77, 90, -24, 0, 0, 0, 0, 91, -119, -33, 82, 69, 85, -119, -27, -127" ascii wide
    $s19 = "Array(77,90,65,82,85,72,-119,-27,72,-127,-20,32,0,0,0,72" ascii wide
    $s20 = "Array(77, 90, 65, 82, 85, 72, -119, -27, 72, -127, -20, 32, 0, 0, 0, 72" ascii wide
    $s21 = "MZ\"&Chr(-27)&Chr(0)&Chr(0)&Chr(0)&Chr(0)&Chr(91)&Chr(-119)&Chr(-33)&\"REU\"&Chr(-119)&Chr(-27)&Chr(-127)" ascii wide
    $s22 = "MZARUH\"&Chr(-119)&Chr(-27)&\"H\"&Chr(-127)&Chr(-20)&Chr(32)&Chr(0)&Chr(0)&Chr(0)&\"H" ascii wide
    $s23 = "\\x4d\\x5a\\xe8\\x00\\x00\\x00\\x00\\x5b\\x89\\xdf\\x52\\x45\\x55\\x89\\xe5\\x81" ascii wide nocase
    $s24 = "\\x4d\\x5a\\x41\\x52\\x55\\x48\\x89\\xe5\\x48\\x81\\xec\\x20\\x00\\x00\\x00\\x48" ascii wide nocase
  condition:
        any of them
}

rule Cobaltbaltstrike_Beacon_XORed_x86
{
  meta:
    description = "Detect the risk of  Malware Cobalt Strike Rule 43"
  strings:
        $h01 = { FC E8??000000 [0-32] EB27 ?? 8B?? 83??04 8B?? 31?? 83??04 ?? 8B?? 31?? 89?? 31?? 83??04 83??04 31?? 39?? 7402 EBEA ?? FF?? E8D4FFFFFF }
        $h02 = { FC E8??000000 [0-32] EB2B ?? 8B??00 83C504 8B??00 31?? 83C504 55 8B??00 31?? 89??00 31?? 83C504 83??04 31?? 39?? 7402 EBE8 ?? FF?? E8D0FFFFFF }
        $h11 = { 7402 EB(E8|EA) ?? FF?? E8(D0|D4)FFFFFF }
  condition:
        any of ($h0*) and (
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x4D5AE800 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x904D5AE8 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90904D5A or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x9090904D or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90909090
        )
}

rule Cobaltbaltstrike_Beacon_XORed_x64
{
  meta:
    description ="Detect the risk of  Malware Cobalt Strike Rule 44"
  strings:
    $h01 = { FC 4883E4F0 EB33 5D 8B4500 4883C504 8B4D00 31C1 4883C504 55 8B5500 31C2 895500 31D0 4883C504 83E904 31D2 39D1 7402 EBE7 58 FC 4883E4F0 FFD0 E8C8FFFFFF }
        $h11 = { FC 4883E4F0 FFD0 E8C8FFFFFF }
  condition:
        $h01 and (
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x4D5A4152 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x904D5A41 or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90904D5A or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x9090904D or
            uint32be(@h11+12) ^ uint32be(@h11+20) == 0x90909090
        )
}

rule CobaltStrike_Sleep_Decoder_Indicator {
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 45"
    strings:
        $sleep_decoder = { 48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 20 4C 8B 51 08 41 8B F0 48 8B EA 48 8B D9 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 }
    condition:
        $sleep_decoder
}

rule CobaltStrike_C2_Encoded_XOR_Config_Indicator {
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 46"
    strings:
        $s000 = { 00 01 00 01 00 02 ?? ?? 00 02 00 01 00 02 ?? ?? 00 03 00 02 00 04 ?? ?? ?? ?? 00 04 00 02 00 04 ?? ?? ?? ?? 00 05 00 01 00 02 ?? ?? }
        $s001 = { 01 00 01 00 01 03 ?? ?? 01 03 01 00 01 03 ?? ?? 01 02 01 03 01 05 ?? ?? ?? ?? 01 05 01 03 01 05 ?? ?? ?? ?? 01 04 01 00 01 03 ?? ?? }
        $s002 = { 02 03 02 03 02 00 ?? ?? 02 00 02 03 02 00 ?? ?? 02 01 02 00 02 06 ?? ?? ?? ?? 02 06 02 00 02 06 ?? ?? ?? ?? 02 07 02 03 02 00 ?? ?? }
        $s003 = { 03 02 03 02 03 01 ?? ?? 03 01 03 02 03 01 ?? ?? 03 00 03 01 03 07 ?? ?? ?? ?? 03 07 03 01 03 07 ?? ?? ?? ?? 03 06 03 02 03 01 ?? ?? }
        $s004 = { 04 05 04 05 04 06 ?? ?? 04 06 04 05 04 06 ?? ?? 04 07 04 06 04 00 ?? ?? ?? ?? 04 00 04 06 04 00 ?? ?? ?? ?? 04 01 04 05 04 06 ?? ?? }
        $s005 = { 05 04 05 04 05 07 ?? ?? 05 07 05 04 05 07 ?? ?? 05 06 05 07 05 01 ?? ?? ?? ?? 05 01 05 07 05 01 ?? ?? ?? ?? 05 00 05 04 05 07 ?? ?? }
        $s006 = { 06 07 06 07 06 04 ?? ?? 06 04 06 07 06 04 ?? ?? 06 05 06 04 06 02 ?? ?? ?? ?? 06 02 06 04 06 02 ?? ?? ?? ?? 06 03 06 07 06 04 ?? ?? }
        $s007 = { 07 06 07 06 07 05 ?? ?? 07 05 07 06 07 05 ?? ?? 07 04 07 05 07 03 ?? ?? ?? ?? 07 03 07 05 07 03 ?? ?? ?? ?? 07 02 07 06 07 05 ?? ?? }
        $s008 = { 08 09 08 09 08 0A ?? ?? 08 0A 08 09 08 0A ?? ?? 08 0B 08 0A 08 0C ?? ?? ?? ?? 08 0C 08 0A 08 0C ?? ?? ?? ?? 08 0D 08 09 08 0A ?? ?? }
        $s009 = { 09 08 09 08 09 0B ?? ?? 09 0B 09 08 09 0B ?? ?? 09 0A 09 0B 09 0D ?? ?? ?? ?? 09 0D 09 0B 09 0D ?? ?? ?? ?? 09 0C 09 08 09 0B ?? ?? }
        $s010 = { 0A 0B 0A 0B 0A 08 ?? ?? 0A 08 0A 0B 0A 08 ?? ?? 0A 09 0A 08 0A 0E ?? ?? ?? ?? 0A 0E 0A 08 0A 0E ?? ?? ?? ?? 0A 0F 0A 0B 0A 08 ?? ?? }
        $s011 = { 0B 0A 0B 0A 0B 09 ?? ?? 0B 09 0B 0A 0B 09 ?? ?? 0B 08 0B 09 0B 0F ?? ?? ?? ?? 0B 0F 0B 09 0B 0F ?? ?? ?? ?? 0B 0E 0B 0A 0B 09 ?? ?? }
        $s012 = { 0C 0D 0C 0D 0C 0E ?? ?? 0C 0E 0C 0D 0C 0E ?? ?? 0C 0F 0C 0E 0C 08 ?? ?? ?? ?? 0C 08 0C 0E 0C 08 ?? ?? ?? ?? 0C 09 0C 0D 0C 0E ?? ?? }
        $s013 = { 0D 0C 0D 0C 0D 0F ?? ?? 0D 0F 0D 0C 0D 0F ?? ?? 0D 0E 0D 0F 0D 09 ?? ?? ?? ?? 0D 09 0D 0F 0D 09 ?? ?? ?? ?? 0D 08 0D 0C 0D 0F ?? ?? }
        $s014 = { 0E 0F 0E 0F 0E 0C ?? ?? 0E 0C 0E 0F 0E 0C ?? ?? 0E 0D 0E 0C 0E 0A ?? ?? ?? ?? 0E 0A 0E 0C 0E 0A ?? ?? ?? ?? 0E 0B 0E 0F 0E 0C ?? ?? }
        $s015 = { 0F 0E 0F 0E 0F 0D ?? ?? 0F 0D 0F 0E 0F 0D ?? ?? 0F 0C 0F 0D 0F 0B ?? ?? ?? ?? 0F 0B 0F 0D 0F 0B ?? ?? ?? ?? 0F 0A 0F 0E 0F 0D ?? ?? }
        $s016 = { 10 11 10 11 10 12 ?? ?? 10 12 10 11 10 12 ?? ?? 10 13 10 12 10 14 ?? ?? ?? ?? 10 14 10 12 10 14 ?? ?? ?? ?? 10 15 10 11 10 12 ?? ?? }
        $s017 = { 11 10 11 10 11 13 ?? ?? 11 13 11 10 11 13 ?? ?? 11 12 11 13 11 15 ?? ?? ?? ?? 11 15 11 13 11 15 ?? ?? ?? ?? 11 14 11 10 11 13 ?? ?? }
        $s018 = { 12 13 12 13 12 10 ?? ?? 12 10 12 13 12 10 ?? ?? 12 11 12 10 12 16 ?? ?? ?? ?? 12 16 12 10 12 16 ?? ?? ?? ?? 12 17 12 13 12 10 ?? ?? }
        $s019 = { 13 12 13 12 13 11 ?? ?? 13 11 13 12 13 11 ?? ?? 13 10 13 11 13 17 ?? ?? ?? ?? 13 17 13 11 13 17 ?? ?? ?? ?? 13 16 13 12 13 11 ?? ?? }
        $s020 = { 14 15 14 15 14 16 ?? ?? 14 16 14 15 14 16 ?? ?? 14 17 14 16 14 10 ?? ?? ?? ?? 14 10 14 16 14 10 ?? ?? ?? ?? 14 11 14 15 14 16 ?? ?? }
        $s021 = { 15 14 15 14 15 17 ?? ?? 15 17 15 14 15 17 ?? ?? 15 16 15 17 15 11 ?? ?? ?? ?? 15 11 15 17 15 11 ?? ?? ?? ?? 15 10 15 14 15 17 ?? ?? }
        $s022 = { 16 17 16 17 16 14 ?? ?? 16 14 16 17 16 14 ?? ?? 16 15 16 14 16 12 ?? ?? ?? ?? 16 12 16 14 16 12 ?? ?? ?? ?? 16 13 16 17 16 14 ?? ?? }
        $s023 = { 17 16 17 16 17 15 ?? ?? 17 15 17 16 17 15 ?? ?? 17 14 17 15 17 13 ?? ?? ?? ?? 17 13 17 15 17 13 ?? ?? ?? ?? 17 12 17 16 17 15 ?? ?? }
        $s024 = { 18 19 18 19 18 1A ?? ?? 18 1A 18 19 18 1A ?? ?? 18 1B 18 1A 18 1C ?? ?? ?? ?? 18 1C 18 1A 18 1C ?? ?? ?? ?? 18 1D 18 19 18 1A ?? ?? }
        $s025 = { 19 18 19 18 19 1B ?? ?? 19 1B 19 18 19 1B ?? ?? 19 1A 19 1B 19 1D ?? ?? ?? ?? 19 1D 19 1B 19 1D ?? ?? ?? ?? 19 1C 19 18 19 1B ?? ?? }
        $s026 = { 1A 1B 1A 1B 1A 18 ?? ?? 1A 18 1A 1B 1A 18 ?? ?? 1A 19 1A 18 1A 1E ?? ?? ?? ?? 1A 1E 1A 18 1A 1E ?? ?? ?? ?? 1A 1F 1A 1B 1A 18 ?? ?? }
        $s027 = { 1B 1A 1B 1A 1B 19 ?? ?? 1B 19 1B 1A 1B 19 ?? ?? 1B 18 1B 19 1B 1F ?? ?? ?? ?? 1B 1F 1B 19 1B 1F ?? ?? ?? ?? 1B 1E 1B 1A 1B 19 ?? ?? }
        $s028 = { 1C 1D 1C 1D 1C 1E ?? ?? 1C 1E 1C 1D 1C 1E ?? ?? 1C 1F 1C 1E 1C 18 ?? ?? ?? ?? 1C 18 1C 1E 1C 18 ?? ?? ?? ?? 1C 19 1C 1D 1C 1E ?? ?? }
        $s029 = { 1D 1C 1D 1C 1D 1F ?? ?? 1D 1F 1D 1C 1D 1F ?? ?? 1D 1E 1D 1F 1D 19 ?? ?? ?? ?? 1D 19 1D 1F 1D 19 ?? ?? ?? ?? 1D 18 1D 1C 1D 1F ?? ?? }
        $s030 = { 1E 1F 1E 1F 1E 1C ?? ?? 1E 1C 1E 1F 1E 1C ?? ?? 1E 1D 1E 1C 1E 1A ?? ?? ?? ?? 1E 1A 1E 1C 1E 1A ?? ?? ?? ?? 1E 1B 1E 1F 1E 1C ?? ?? }
        $s031 = { 1F 1E 1F 1E 1F 1D ?? ?? 1F 1D 1F 1E 1F 1D ?? ?? 1F 1C 1F 1D 1F 1B ?? ?? ?? ?? 1F 1B 1F 1D 1F 1B ?? ?? ?? ?? 1F 1A 1F 1E 1F 1D ?? ?? }
        $s032 = { 20 21 20 21 20 22 ?? ?? 20 22 20 21 20 22 ?? ?? 20 23 20 22 20 24 ?? ?? ?? ?? 20 24 20 22 20 24 ?? ?? ?? ?? 20 25 20 21 20 22 ?? ?? }
        $s033 = { 21 20 21 20 21 23 ?? ?? 21 23 21 20 21 23 ?? ?? 21 22 21 23 21 25 ?? ?? ?? ?? 21 25 21 23 21 25 ?? ?? ?? ?? 21 24 21 20 21 23 ?? ?? }
        $s034 = { 22 23 22 23 22 20 ?? ?? 22 20 22 23 22 20 ?? ?? 22 21 22 20 22 26 ?? ?? ?? ?? 22 26 22 20 22 26 ?? ?? ?? ?? 22 27 22 23 22 20 ?? ?? }
        $s035 = { 23 22 23 22 23 21 ?? ?? 23 21 23 22 23 21 ?? ?? 23 20 23 21 23 27 ?? ?? ?? ?? 23 27 23 21 23 27 ?? ?? ?? ?? 23 26 23 22 23 21 ?? ?? }
        $s036 = { 24 25 24 25 24 26 ?? ?? 24 26 24 25 24 26 ?? ?? 24 27 24 26 24 20 ?? ?? ?? ?? 24 20 24 26 24 20 ?? ?? ?? ?? 24 21 24 25 24 26 ?? ?? }
        $s037 = { 25 24 25 24 25 27 ?? ?? 25 27 25 24 25 27 ?? ?? 25 26 25 27 25 21 ?? ?? ?? ?? 25 21 25 27 25 21 ?? ?? ?? ?? 25 20 25 24 25 27 ?? ?? }
        $s038 = { 26 27 26 27 26 24 ?? ?? 26 24 26 27 26 24 ?? ?? 26 25 26 24 26 22 ?? ?? ?? ?? 26 22 26 24 26 22 ?? ?? ?? ?? 26 23 26 27 26 24 ?? ?? }
        $s039 = { 27 26 27 26 27 25 ?? ?? 27 25 27 26 27 25 ?? ?? 27 24 27 25 27 23 ?? ?? ?? ?? 27 23 27 25 27 23 ?? ?? ?? ?? 27 22 27 26 27 25 ?? ?? }
        $s040 = { 28 29 28 29 28 2A ?? ?? 28 2A 28 29 28 2A ?? ?? 28 2B 28 2A 28 2C ?? ?? ?? ?? 28 2C 28 2A 28 2C ?? ?? ?? ?? 28 2D 28 29 28 2A ?? ?? }
        $s041 = { 29 28 29 28 29 2B ?? ?? 29 2B 29 28 29 2B ?? ?? 29 2A 29 2B 29 2D ?? ?? ?? ?? 29 2D 29 2B 29 2D ?? ?? ?? ?? 29 2C 29 28 29 2B ?? ?? }
        $s042 = { 2A 2B 2A 2B 2A 28 ?? ?? 2A 28 2A 2B 2A 28 ?? ?? 2A 29 2A 28 2A 2E ?? ?? ?? ?? 2A 2E 2A 28 2A 2E ?? ?? ?? ?? 2A 2F 2A 2B 2A 28 ?? ?? }
        $s043 = { 2B 2A 2B 2A 2B 29 ?? ?? 2B 29 2B 2A 2B 29 ?? ?? 2B 28 2B 29 2B 2F ?? ?? ?? ?? 2B 2F 2B 29 2B 2F ?? ?? ?? ?? 2B 2E 2B 2A 2B 29 ?? ?? }
        $s044 = { 2C 2D 2C 2D 2C 2E ?? ?? 2C 2E 2C 2D 2C 2E ?? ?? 2C 2F 2C 2E 2C 28 ?? ?? ?? ?? 2C 28 2C 2E 2C 28 ?? ?? ?? ?? 2C 29 2C 2D 2C 2E ?? ?? }
        $s045 = { 2D 2C 2D 2C 2D 2F ?? ?? 2D 2F 2D 2C 2D 2F ?? ?? 2D 2E 2D 2F 2D 29 ?? ?? ?? ?? 2D 29 2D 2F 2D 29 ?? ?? ?? ?? 2D 28 2D 2C 2D 2F ?? ?? }
        $s046 = { 2E 2F 2E 2F 2E 2C ?? ?? 2E 2C 2E 2F 2E 2C ?? ?? 2E 2D 2E 2C 2E 2A ?? ?? ?? ?? 2E 2A 2E 2C 2E 2A ?? ?? ?? ?? 2E 2B 2E 2F 2E 2C ?? ?? }
        $s047 = { 2F 2E 2F 2E 2F 2D ?? ?? 2F 2D 2F 2E 2F 2D ?? ?? 2F 2C 2F 2D 2F 2B ?? ?? ?? ?? 2F 2B 2F 2D 2F 2B ?? ?? ?? ?? 2F 2A 2F 2E 2F 2D ?? ?? }
        $s048 = { 30 31 30 31 30 32 ?? ?? 30 32 30 31 30 32 ?? ?? 30 33 30 32 30 34 ?? ?? ?? ?? 30 34 30 32 30 34 ?? ?? ?? ?? 30 35 30 31 30 32 ?? ?? }
        $s049 = { 31 30 31 30 31 33 ?? ?? 31 33 31 30 31 33 ?? ?? 31 32 31 33 31 35 ?? ?? ?? ?? 31 35 31 33 31 35 ?? ?? ?? ?? 31 34 31 30 31 33 ?? ?? }
        $s050 = { 32 33 32 33 32 30 ?? ?? 32 30 32 33 32 30 ?? ?? 32 31 32 30 32 36 ?? ?? ?? ?? 32 36 32 30 32 36 ?? ?? ?? ?? 32 37 32 33 32 30 ?? ?? }
        $s051 = { 33 32 33 32 33 31 ?? ?? 33 31 33 32 33 31 ?? ?? 33 30 33 31 33 37 ?? ?? ?? ?? 33 37 33 31 33 37 ?? ?? ?? ?? 33 36 33 32 33 31 ?? ?? }
        $s052 = { 34 35 34 35 34 36 ?? ?? 34 36 34 35 34 36 ?? ?? 34 37 34 36 34 30 ?? ?? ?? ?? 34 30 34 36 34 30 ?? ?? ?? ?? 34 31 34 35 34 36 ?? ?? }
        $s053 = { 35 34 35 34 35 37 ?? ?? 35 37 35 34 35 37 ?? ?? 35 36 35 37 35 31 ?? ?? ?? ?? 35 31 35 37 35 31 ?? ?? ?? ?? 35 30 35 34 35 37 ?? ?? }
        $s054 = { 36 37 36 37 36 34 ?? ?? 36 34 36 37 36 34 ?? ?? 36 35 36 34 36 32 ?? ?? ?? ?? 36 32 36 34 36 32 ?? ?? ?? ?? 36 33 36 37 36 34 ?? ?? }
        $s055 = { 37 36 37 36 37 35 ?? ?? 37 35 37 36 37 35 ?? ?? 37 34 37 35 37 33 ?? ?? ?? ?? 37 33 37 35 37 33 ?? ?? ?? ?? 37 32 37 36 37 35 ?? ?? }
        $s056 = { 38 39 38 39 38 3A ?? ?? 38 3A 38 39 38 3A ?? ?? 38 3B 38 3A 38 3C ?? ?? ?? ?? 38 3C 38 3A 38 3C ?? ?? ?? ?? 38 3D 38 39 38 3A ?? ?? }
        $s057 = { 39 38 39 38 39 3B ?? ?? 39 3B 39 38 39 3B ?? ?? 39 3A 39 3B 39 3D ?? ?? ?? ?? 39 3D 39 3B 39 3D ?? ?? ?? ?? 39 3C 39 38 39 3B ?? ?? }
        $s058 = { 3A 3B 3A 3B 3A 38 ?? ?? 3A 38 3A 3B 3A 38 ?? ?? 3A 39 3A 38 3A 3E ?? ?? ?? ?? 3A 3E 3A 38 3A 3E ?? ?? ?? ?? 3A 3F 3A 3B 3A 38 ?? ?? }
        $s059 = { 3B 3A 3B 3A 3B 39 ?? ?? 3B 39 3B 3A 3B 39 ?? ?? 3B 38 3B 39 3B 3F ?? ?? ?? ?? 3B 3F 3B 39 3B 3F ?? ?? ?? ?? 3B 3E 3B 3A 3B 39 ?? ?? }
        $s060 = { 3C 3D 3C 3D 3C 3E ?? ?? 3C 3E 3C 3D 3C 3E ?? ?? 3C 3F 3C 3E 3C 38 ?? ?? ?? ?? 3C 38 3C 3E 3C 38 ?? ?? ?? ?? 3C 39 3C 3D 3C 3E ?? ?? }
        $s061 = { 3D 3C 3D 3C 3D 3F ?? ?? 3D 3F 3D 3C 3D 3F ?? ?? 3D 3E 3D 3F 3D 39 ?? ?? ?? ?? 3D 39 3D 3F 3D 39 ?? ?? ?? ?? 3D 38 3D 3C 3D 3F ?? ?? }
        $s062 = { 3E 3F 3E 3F 3E 3C ?? ?? 3E 3C 3E 3F 3E 3C ?? ?? 3E 3D 3E 3C 3E 3A ?? ?? ?? ?? 3E 3A 3E 3C 3E 3A ?? ?? ?? ?? 3E 3B 3E 3F 3E 3C ?? ?? }
        $s063 = { 3F 3E 3F 3E 3F 3D ?? ?? 3F 3D 3F 3E 3F 3D ?? ?? 3F 3C 3F 3D 3F 3B ?? ?? ?? ?? 3F 3B 3F 3D 3F 3B ?? ?? ?? ?? 3F 3A 3F 3E 3F 3D ?? ?? }
        $s064 = { 40 41 40 41 40 42 ?? ?? 40 42 40 41 40 42 ?? ?? 40 43 40 42 40 44 ?? ?? ?? ?? 40 44 40 42 40 44 ?? ?? ?? ?? 40 45 40 41 40 42 ?? ?? }
        $s065 = { 41 40 41 40 41 43 ?? ?? 41 43 41 40 41 43 ?? ?? 41 42 41 43 41 45 ?? ?? ?? ?? 41 45 41 43 41 45 ?? ?? ?? ?? 41 44 41 40 41 43 ?? ?? }
        $s066 = { 42 43 42 43 42 40 ?? ?? 42 40 42 43 42 40 ?? ?? 42 41 42 40 42 46 ?? ?? ?? ?? 42 46 42 40 42 46 ?? ?? ?? ?? 42 47 42 43 42 40 ?? ?? }
        $s067 = { 43 42 43 42 43 41 ?? ?? 43 41 43 42 43 41 ?? ?? 43 40 43 41 43 47 ?? ?? ?? ?? 43 47 43 41 43 47 ?? ?? ?? ?? 43 46 43 42 43 41 ?? ?? }
        $s068 = { 44 45 44 45 44 46 ?? ?? 44 46 44 45 44 46 ?? ?? 44 47 44 46 44 40 ?? ?? ?? ?? 44 40 44 46 44 40 ?? ?? ?? ?? 44 41 44 45 44 46 ?? ?? }
        $s069 = { 45 44 45 44 45 47 ?? ?? 45 47 45 44 45 47 ?? ?? 45 46 45 47 45 41 ?? ?? ?? ?? 45 41 45 47 45 41 ?? ?? ?? ?? 45 40 45 44 45 47 ?? ?? }
        $s070 = { 46 47 46 47 46 44 ?? ?? 46 44 46 47 46 44 ?? ?? 46 45 46 44 46 42 ?? ?? ?? ?? 46 42 46 44 46 42 ?? ?? ?? ?? 46 43 46 47 46 44 ?? ?? }
        $s071 = { 47 46 47 46 47 45 ?? ?? 47 45 47 46 47 45 ?? ?? 47 44 47 45 47 43 ?? ?? ?? ?? 47 43 47 45 47 43 ?? ?? ?? ?? 47 42 47 46 47 45 ?? ?? }
        $s072 = { 48 49 48 49 48 4A ?? ?? 48 4A 48 49 48 4A ?? ?? 48 4B 48 4A 48 4C ?? ?? ?? ?? 48 4C 48 4A 48 4C ?? ?? ?? ?? 48 4D 48 49 48 4A ?? ?? }
        $s073 = { 49 48 49 48 49 4B ?? ?? 49 4B 49 48 49 4B ?? ?? 49 4A 49 4B 49 4D ?? ?? ?? ?? 49 4D 49 4B 49 4D ?? ?? ?? ?? 49 4C 49 48 49 4B ?? ?? }
        $s074 = { 4A 4B 4A 4B 4A 48 ?? ?? 4A 48 4A 4B 4A 48 ?? ?? 4A 49 4A 48 4A 4E ?? ?? ?? ?? 4A 4E 4A 48 4A 4E ?? ?? ?? ?? 4A 4F 4A 4B 4A 48 ?? ?? }
        $s075 = { 4B 4A 4B 4A 4B 49 ?? ?? 4B 49 4B 4A 4B 49 ?? ?? 4B 48 4B 49 4B 4F ?? ?? ?? ?? 4B 4F 4B 49 4B 4F ?? ?? ?? ?? 4B 4E 4B 4A 4B 49 ?? ?? }
        $s076 = { 4C 4D 4C 4D 4C 4E ?? ?? 4C 4E 4C 4D 4C 4E ?? ?? 4C 4F 4C 4E 4C 48 ?? ?? ?? ?? 4C 48 4C 4E 4C 48 ?? ?? ?? ?? 4C 49 4C 4D 4C 4E ?? ?? }
        $s077 = { 4D 4C 4D 4C 4D 4F ?? ?? 4D 4F 4D 4C 4D 4F ?? ?? 4D 4E 4D 4F 4D 49 ?? ?? ?? ?? 4D 49 4D 4F 4D 49 ?? ?? ?? ?? 4D 48 4D 4C 4D 4F ?? ?? }
        $s078 = { 4E 4F 4E 4F 4E 4C ?? ?? 4E 4C 4E 4F 4E 4C ?? ?? 4E 4D 4E 4C 4E 4A ?? ?? ?? ?? 4E 4A 4E 4C 4E 4A ?? ?? ?? ?? 4E 4B 4E 4F 4E 4C ?? ?? }
        $s079 = { 4F 4E 4F 4E 4F 4D ?? ?? 4F 4D 4F 4E 4F 4D ?? ?? 4F 4C 4F 4D 4F 4B ?? ?? ?? ?? 4F 4B 4F 4D 4F 4B ?? ?? ?? ?? 4F 4A 4F 4E 4F 4D ?? ?? }
        $s080 = { 50 51 50 51 50 52 ?? ?? 50 52 50 51 50 52 ?? ?? 50 53 50 52 50 54 ?? ?? ?? ?? 50 54 50 52 50 54 ?? ?? ?? ?? 50 55 50 51 50 52 ?? ?? }
        $s081 = { 51 50 51 50 51 53 ?? ?? 51 53 51 50 51 53 ?? ?? 51 52 51 53 51 55 ?? ?? ?? ?? 51 55 51 53 51 55 ?? ?? ?? ?? 51 54 51 50 51 53 ?? ?? }
        $s082 = { 52 53 52 53 52 50 ?? ?? 52 50 52 53 52 50 ?? ?? 52 51 52 50 52 56 ?? ?? ?? ?? 52 56 52 50 52 56 ?? ?? ?? ?? 52 57 52 53 52 50 ?? ?? }
        $s083 = { 53 52 53 52 53 51 ?? ?? 53 51 53 52 53 51 ?? ?? 53 50 53 51 53 57 ?? ?? ?? ?? 53 57 53 51 53 57 ?? ?? ?? ?? 53 56 53 52 53 51 ?? ?? }
        $s084 = { 54 55 54 55 54 56 ?? ?? 54 56 54 55 54 56 ?? ?? 54 57 54 56 54 50 ?? ?? ?? ?? 54 50 54 56 54 50 ?? ?? ?? ?? 54 51 54 55 54 56 ?? ?? }
        $s085 = { 55 54 55 54 55 57 ?? ?? 55 57 55 54 55 57 ?? ?? 55 56 55 57 55 51 ?? ?? ?? ?? 55 51 55 57 55 51 ?? ?? ?? ?? 55 50 55 54 55 57 ?? ?? }
        $s086 = { 56 57 56 57 56 54 ?? ?? 56 54 56 57 56 54 ?? ?? 56 55 56 54 56 52 ?? ?? ?? ?? 56 52 56 54 56 52 ?? ?? ?? ?? 56 53 56 57 56 54 ?? ?? }
        $s087 = { 57 56 57 56 57 55 ?? ?? 57 55 57 56 57 55 ?? ?? 57 54 57 55 57 53 ?? ?? ?? ?? 57 53 57 55 57 53 ?? ?? ?? ?? 57 52 57 56 57 55 ?? ?? }
        $s088 = { 58 59 58 59 58 5A ?? ?? 58 5A 58 59 58 5A ?? ?? 58 5B 58 5A 58 5C ?? ?? ?? ?? 58 5C 58 5A 58 5C ?? ?? ?? ?? 58 5D 58 59 58 5A ?? ?? }
        $s089 = { 59 58 59 58 59 5B ?? ?? 59 5B 59 58 59 5B ?? ?? 59 5A 59 5B 59 5D ?? ?? ?? ?? 59 5D 59 5B 59 5D ?? ?? ?? ?? 59 5C 59 58 59 5B ?? ?? }
        $s090 = { 5A 5B 5A 5B 5A 58 ?? ?? 5A 58 5A 5B 5A 58 ?? ?? 5A 59 5A 58 5A 5E ?? ?? ?? ?? 5A 5E 5A 58 5A 5E ?? ?? ?? ?? 5A 5F 5A 5B 5A 58 ?? ?? }
        $s091 = { 5B 5A 5B 5A 5B 59 ?? ?? 5B 59 5B 5A 5B 59 ?? ?? 5B 58 5B 59 5B 5F ?? ?? ?? ?? 5B 5F 5B 59 5B 5F ?? ?? ?? ?? 5B 5E 5B 5A 5B 59 ?? ?? }
        $s092 = { 5C 5D 5C 5D 5C 5E ?? ?? 5C 5E 5C 5D 5C 5E ?? ?? 5C 5F 5C 5E 5C 58 ?? ?? ?? ?? 5C 58 5C 5E 5C 58 ?? ?? ?? ?? 5C 59 5C 5D 5C 5E ?? ?? }
        $s093 = { 5D 5C 5D 5C 5D 5F ?? ?? 5D 5F 5D 5C 5D 5F ?? ?? 5D 5E 5D 5F 5D 59 ?? ?? ?? ?? 5D 59 5D 5F 5D 59 ?? ?? ?? ?? 5D 58 5D 5C 5D 5F ?? ?? }
        $s094 = { 5E 5F 5E 5F 5E 5C ?? ?? 5E 5C 5E 5F 5E 5C ?? ?? 5E 5D 5E 5C 5E 5A ?? ?? ?? ?? 5E 5A 5E 5C 5E 5A ?? ?? ?? ?? 5E 5B 5E 5F 5E 5C ?? ?? }
        $s095 = { 5F 5E 5F 5E 5F 5D ?? ?? 5F 5D 5F 5E 5F 5D ?? ?? 5F 5C 5F 5D 5F 5B ?? ?? ?? ?? 5F 5B 5F 5D 5F 5B ?? ?? ?? ?? 5F 5A 5F 5E 5F 5D ?? ?? }
        $s096 = { 60 61 60 61 60 62 ?? ?? 60 62 60 61 60 62 ?? ?? 60 63 60 62 60 64 ?? ?? ?? ?? 60 64 60 62 60 64 ?? ?? ?? ?? 60 65 60 61 60 62 ?? ?? }
        $s097 = { 61 60 61 60 61 63 ?? ?? 61 63 61 60 61 63 ?? ?? 61 62 61 63 61 65 ?? ?? ?? ?? 61 65 61 63 61 65 ?? ?? ?? ?? 61 64 61 60 61 63 ?? ?? }
        $s098 = { 62 63 62 63 62 60 ?? ?? 62 60 62 63 62 60 ?? ?? 62 61 62 60 62 66 ?? ?? ?? ?? 62 66 62 60 62 66 ?? ?? ?? ?? 62 67 62 63 62 60 ?? ?? }
        $s099 = { 63 62 63 62 63 61 ?? ?? 63 61 63 62 63 61 ?? ?? 63 60 63 61 63 67 ?? ?? ?? ?? 63 67 63 61 63 67 ?? ?? ?? ?? 63 66 63 62 63 61 ?? ?? }
        $s100 = { 64 65 64 65 64 66 ?? ?? 64 66 64 65 64 66 ?? ?? 64 67 64 66 64 60 ?? ?? ?? ?? 64 60 64 66 64 60 ?? ?? ?? ?? 64 61 64 65 64 66 ?? ?? }
        $s101 = { 65 64 65 64 65 67 ?? ?? 65 67 65 64 65 67 ?? ?? 65 66 65 67 65 61 ?? ?? ?? ?? 65 61 65 67 65 61 ?? ?? ?? ?? 65 60 65 64 65 67 ?? ?? }
        $s102 = { 66 67 66 67 66 64 ?? ?? 66 64 66 67 66 64 ?? ?? 66 65 66 64 66 62 ?? ?? ?? ?? 66 62 66 64 66 62 ?? ?? ?? ?? 66 63 66 67 66 64 ?? ?? }
        $s103 = { 67 66 67 66 67 65 ?? ?? 67 65 67 66 67 65 ?? ?? 67 64 67 65 67 63 ?? ?? ?? ?? 67 63 67 65 67 63 ?? ?? ?? ?? 67 62 67 66 67 65 ?? ?? }
        $s104 = { 68 69 68 69 68 6A ?? ?? 68 6A 68 69 68 6A ?? ?? 68 6B 68 6A 68 6C ?? ?? ?? ?? 68 6C 68 6A 68 6C ?? ?? ?? ?? 68 6D 68 69 68 6A ?? ?? }
        $s105 = { 69 68 69 68 69 6B ?? ?? 69 6B 69 68 69 6B ?? ?? 69 6A 69 6B 69 6D ?? ?? ?? ?? 69 6D 69 6B 69 6D ?? ?? ?? ?? 69 6C 69 68 69 6B ?? ?? }
        $s106 = { 6A 6B 6A 6B 6A 68 ?? ?? 6A 68 6A 6B 6A 68 ?? ?? 6A 69 6A 68 6A 6E ?? ?? ?? ?? 6A 6E 6A 68 6A 6E ?? ?? ?? ?? 6A 6F 6A 6B 6A 68 ?? ?? }
        $s107 = { 6B 6A 6B 6A 6B 69 ?? ?? 6B 69 6B 6A 6B 69 ?? ?? 6B 68 6B 69 6B 6F ?? ?? ?? ?? 6B 6F 6B 69 6B 6F ?? ?? ?? ?? 6B 6E 6B 6A 6B 69 ?? ?? }
        $s108 = { 6C 6D 6C 6D 6C 6E ?? ?? 6C 6E 6C 6D 6C 6E ?? ?? 6C 6F 6C 6E 6C 68 ?? ?? ?? ?? 6C 68 6C 6E 6C 68 ?? ?? ?? ?? 6C 69 6C 6D 6C 6E ?? ?? }
        $s109 = { 6D 6C 6D 6C 6D 6F ?? ?? 6D 6F 6D 6C 6D 6F ?? ?? 6D 6E 6D 6F 6D 69 ?? ?? ?? ?? 6D 69 6D 6F 6D 69 ?? ?? ?? ?? 6D 68 6D 6C 6D 6F ?? ?? }
        $s110 = { 6E 6F 6E 6F 6E 6C ?? ?? 6E 6C 6E 6F 6E 6C ?? ?? 6E 6D 6E 6C 6E 6A ?? ?? ?? ?? 6E 6A 6E 6C 6E 6A ?? ?? ?? ?? 6E 6B 6E 6F 6E 6C ?? ?? }
        $s111 = { 6F 6E 6F 6E 6F 6D ?? ?? 6F 6D 6F 6E 6F 6D ?? ?? 6F 6C 6F 6D 6F 6B ?? ?? ?? ?? 6F 6B 6F 6D 6F 6B ?? ?? ?? ?? 6F 6A 6F 6E 6F 6D ?? ?? }
        $s112 = { 70 71 70 71 70 72 ?? ?? 70 72 70 71 70 72 ?? ?? 70 73 70 72 70 74 ?? ?? ?? ?? 70 74 70 72 70 74 ?? ?? ?? ?? 70 75 70 71 70 72 ?? ?? }
        $s113 = { 71 70 71 70 71 73 ?? ?? 71 73 71 70 71 73 ?? ?? 71 72 71 73 71 75 ?? ?? ?? ?? 71 75 71 73 71 75 ?? ?? ?? ?? 71 74 71 70 71 73 ?? ?? }
        $s114 = { 72 73 72 73 72 70 ?? ?? 72 70 72 73 72 70 ?? ?? 72 71 72 70 72 76 ?? ?? ?? ?? 72 76 72 70 72 76 ?? ?? ?? ?? 72 77 72 73 72 70 ?? ?? }
        $s115 = { 73 72 73 72 73 71 ?? ?? 73 71 73 72 73 71 ?? ?? 73 70 73 71 73 77 ?? ?? ?? ?? 73 77 73 71 73 77 ?? ?? ?? ?? 73 76 73 72 73 71 ?? ?? }
        $s116 = { 74 75 74 75 74 76 ?? ?? 74 76 74 75 74 76 ?? ?? 74 77 74 76 74 70 ?? ?? ?? ?? 74 70 74 76 74 70 ?? ?? ?? ?? 74 71 74 75 74 76 ?? ?? }
        $s117 = { 75 74 75 74 75 77 ?? ?? 75 77 75 74 75 77 ?? ?? 75 76 75 77 75 71 ?? ?? ?? ?? 75 71 75 77 75 71 ?? ?? ?? ?? 75 70 75 74 75 77 ?? ?? }
        $s118 = { 76 77 76 77 76 74 ?? ?? 76 74 76 77 76 74 ?? ?? 76 75 76 74 76 72 ?? ?? ?? ?? 76 72 76 74 76 72 ?? ?? ?? ?? 76 73 76 77 76 74 ?? ?? }
        $s119 = { 77 76 77 76 77 75 ?? ?? 77 75 77 76 77 75 ?? ?? 77 74 77 75 77 73 ?? ?? ?? ?? 77 73 77 75 77 73 ?? ?? ?? ?? 77 72 77 76 77 75 ?? ?? }
        $s120 = { 78 79 78 79 78 7A ?? ?? 78 7A 78 79 78 7A ?? ?? 78 7B 78 7A 78 7C ?? ?? ?? ?? 78 7C 78 7A 78 7C ?? ?? ?? ?? 78 7D 78 79 78 7A ?? ?? }
        $s121 = { 79 78 79 78 79 7B ?? ?? 79 7B 79 78 79 7B ?? ?? 79 7A 79 7B 79 7D ?? ?? ?? ?? 79 7D 79 7B 79 7D ?? ?? ?? ?? 79 7C 79 78 79 7B ?? ?? }
        $s122 = { 7A 7B 7A 7B 7A 78 ?? ?? 7A 78 7A 7B 7A 78 ?? ?? 7A 79 7A 78 7A 7E ?? ?? ?? ?? 7A 7E 7A 78 7A 7E ?? ?? ?? ?? 7A 7F 7A 7B 7A 78 ?? ?? }
        $s123 = { 7B 7A 7B 7A 7B 79 ?? ?? 7B 79 7B 7A 7B 79 ?? ?? 7B 78 7B 79 7B 7F ?? ?? ?? ?? 7B 7F 7B 79 7B 7F ?? ?? ?? ?? 7B 7E 7B 7A 7B 79 ?? ?? }
        $s124 = { 7C 7D 7C 7D 7C 7E ?? ?? 7C 7E 7C 7D 7C 7E ?? ?? 7C 7F 7C 7E 7C 78 ?? ?? ?? ?? 7C 78 7C 7E 7C 78 ?? ?? ?? ?? 7C 79 7C 7D 7C 7E ?? ?? }
        $s125 = { 7D 7C 7D 7C 7D 7F ?? ?? 7D 7F 7D 7C 7D 7F ?? ?? 7D 7E 7D 7F 7D 79 ?? ?? ?? ?? 7D 79 7D 7F 7D 79 ?? ?? ?? ?? 7D 78 7D 7C 7D 7F ?? ?? }
        $s126 = { 7E 7F 7E 7F 7E 7C ?? ?? 7E 7C 7E 7F 7E 7C ?? ?? 7E 7D 7E 7C 7E 7A ?? ?? ?? ?? 7E 7A 7E 7C 7E 7A ?? ?? ?? ?? 7E 7B 7E 7F 7E 7C ?? ?? }
        $s127 = { 7F 7E 7F 7E 7F 7D ?? ?? 7F 7D 7F 7E 7F 7D ?? ?? 7F 7C 7F 7D 7F 7B ?? ?? ?? ?? 7F 7B 7F 7D 7F 7B ?? ?? ?? ?? 7F 7A 7F 7E 7F 7D ?? ?? }
        $s128 = { 80 81 80 81 80 82 ?? ?? 80 82 80 81 80 82 ?? ?? 80 83 80 82 80 84 ?? ?? ?? ?? 80 84 80 82 80 84 ?? ?? ?? ?? 80 85 80 81 80 82 ?? ?? }
        $s129 = { 81 80 81 80 81 83 ?? ?? 81 83 81 80 81 83 ?? ?? 81 82 81 83 81 85 ?? ?? ?? ?? 81 85 81 83 81 85 ?? ?? ?? ?? 81 84 81 80 81 83 ?? ?? }
        $s130 = { 82 83 82 83 82 80 ?? ?? 82 80 82 83 82 80 ?? ?? 82 81 82 80 82 86 ?? ?? ?? ?? 82 86 82 80 82 86 ?? ?? ?? ?? 82 87 82 83 82 80 ?? ?? }
        $s131 = { 83 82 83 82 83 81 ?? ?? 83 81 83 82 83 81 ?? ?? 83 80 83 81 83 87 ?? ?? ?? ?? 83 87 83 81 83 87 ?? ?? ?? ?? 83 86 83 82 83 81 ?? ?? }
        $s132 = { 84 85 84 85 84 86 ?? ?? 84 86 84 85 84 86 ?? ?? 84 87 84 86 84 80 ?? ?? ?? ?? 84 80 84 86 84 80 ?? ?? ?? ?? 84 81 84 85 84 86 ?? ?? }
        $s133 = { 85 84 85 84 85 87 ?? ?? 85 87 85 84 85 87 ?? ?? 85 86 85 87 85 81 ?? ?? ?? ?? 85 81 85 87 85 81 ?? ?? ?? ?? 85 80 85 84 85 87 ?? ?? }
        $s134 = { 86 87 86 87 86 84 ?? ?? 86 84 86 87 86 84 ?? ?? 86 85 86 84 86 82 ?? ?? ?? ?? 86 82 86 84 86 82 ?? ?? ?? ?? 86 83 86 87 86 84 ?? ?? }
        $s135 = { 87 86 87 86 87 85 ?? ?? 87 85 87 86 87 85 ?? ?? 87 84 87 85 87 83 ?? ?? ?? ?? 87 83 87 85 87 83 ?? ?? ?? ?? 87 82 87 86 87 85 ?? ?? }
        $s136 = { 88 89 88 89 88 8A ?? ?? 88 8A 88 89 88 8A ?? ?? 88 8B 88 8A 88 8C ?? ?? ?? ?? 88 8C 88 8A 88 8C ?? ?? ?? ?? 88 8D 88 89 88 8A ?? ?? }
        $s137 = { 89 88 89 88 89 8B ?? ?? 89 8B 89 88 89 8B ?? ?? 89 8A 89 8B 89 8D ?? ?? ?? ?? 89 8D 89 8B 89 8D ?? ?? ?? ?? 89 8C 89 88 89 8B ?? ?? }
        $s138 = { 8A 8B 8A 8B 8A 88 ?? ?? 8A 88 8A 8B 8A 88 ?? ?? 8A 89 8A 88 8A 8E ?? ?? ?? ?? 8A 8E 8A 88 8A 8E ?? ?? ?? ?? 8A 8F 8A 8B 8A 88 ?? ?? }
        $s139 = { 8B 8A 8B 8A 8B 89 ?? ?? 8B 89 8B 8A 8B 89 ?? ?? 8B 88 8B 89 8B 8F ?? ?? ?? ?? 8B 8F 8B 89 8B 8F ?? ?? ?? ?? 8B 8E 8B 8A 8B 89 ?? ?? }
        $s140 = { 8C 8D 8C 8D 8C 8E ?? ?? 8C 8E 8C 8D 8C 8E ?? ?? 8C 8F 8C 8E 8C 88 ?? ?? ?? ?? 8C 88 8C 8E 8C 88 ?? ?? ?? ?? 8C 89 8C 8D 8C 8E ?? ?? }
        $s141 = { 8D 8C 8D 8C 8D 8F ?? ?? 8D 8F 8D 8C 8D 8F ?? ?? 8D 8E 8D 8F 8D 89 ?? ?? ?? ?? 8D 89 8D 8F 8D 89 ?? ?? ?? ?? 8D 88 8D 8C 8D 8F ?? ?? }
        $s142 = { 8E 8F 8E 8F 8E 8C ?? ?? 8E 8C 8E 8F 8E 8C ?? ?? 8E 8D 8E 8C 8E 8A ?? ?? ?? ?? 8E 8A 8E 8C 8E 8A ?? ?? ?? ?? 8E 8B 8E 8F 8E 8C ?? ?? }
        $s143 = { 8F 8E 8F 8E 8F 8D ?? ?? 8F 8D 8F 8E 8F 8D ?? ?? 8F 8C 8F 8D 8F 8B ?? ?? ?? ?? 8F 8B 8F 8D 8F 8B ?? ?? ?? ?? 8F 8A 8F 8E 8F 8D ?? ?? }
        $s144 = { 90 91 90 91 90 92 ?? ?? 90 92 90 91 90 92 ?? ?? 90 93 90 92 90 94 ?? ?? ?? ?? 90 94 90 92 90 94 ?? ?? ?? ?? 90 95 90 91 90 92 ?? ?? }
        $s145 = { 91 90 91 90 91 93 ?? ?? 91 93 91 90 91 93 ?? ?? 91 92 91 93 91 95 ?? ?? ?? ?? 91 95 91 93 91 95 ?? ?? ?? ?? 91 94 91 90 91 93 ?? ?? }
        $s146 = { 92 93 92 93 92 90 ?? ?? 92 90 92 93 92 90 ?? ?? 92 91 92 90 92 96 ?? ?? ?? ?? 92 96 92 90 92 96 ?? ?? ?? ?? 92 97 92 93 92 90 ?? ?? }
        $s147 = { 93 92 93 92 93 91 ?? ?? 93 91 93 92 93 91 ?? ?? 93 90 93 91 93 97 ?? ?? ?? ?? 93 97 93 91 93 97 ?? ?? ?? ?? 93 96 93 92 93 91 ?? ?? }
        $s148 = { 94 95 94 95 94 96 ?? ?? 94 96 94 95 94 96 ?? ?? 94 97 94 96 94 90 ?? ?? ?? ?? 94 90 94 96 94 90 ?? ?? ?? ?? 94 91 94 95 94 96 ?? ?? }
        $s149 = { 95 94 95 94 95 97 ?? ?? 95 97 95 94 95 97 ?? ?? 95 96 95 97 95 91 ?? ?? ?? ?? 95 91 95 97 95 91 ?? ?? ?? ?? 95 90 95 94 95 97 ?? ?? }
        $s150 = { 96 97 96 97 96 94 ?? ?? 96 94 96 97 96 94 ?? ?? 96 95 96 94 96 92 ?? ?? ?? ?? 96 92 96 94 96 92 ?? ?? ?? ?? 96 93 96 97 96 94 ?? ?? }
        $s151 = { 97 96 97 96 97 95 ?? ?? 97 95 97 96 97 95 ?? ?? 97 94 97 95 97 93 ?? ?? ?? ?? 97 93 97 95 97 93 ?? ?? ?? ?? 97 92 97 96 97 95 ?? ?? }
        $s152 = { 98 99 98 99 98 9A ?? ?? 98 9A 98 99 98 9A ?? ?? 98 9B 98 9A 98 9C ?? ?? ?? ?? 98 9C 98 9A 98 9C ?? ?? ?? ?? 98 9D 98 99 98 9A ?? ?? }
        $s153 = { 99 98 99 98 99 9B ?? ?? 99 9B 99 98 99 9B ?? ?? 99 9A 99 9B 99 9D ?? ?? ?? ?? 99 9D 99 9B 99 9D ?? ?? ?? ?? 99 9C 99 98 99 9B ?? ?? }
        $s154 = { 9A 9B 9A 9B 9A 98 ?? ?? 9A 98 9A 9B 9A 98 ?? ?? 9A 99 9A 98 9A 9E ?? ?? ?? ?? 9A 9E 9A 98 9A 9E ?? ?? ?? ?? 9A 9F 9A 9B 9A 98 ?? ?? }
        $s155 = { 9B 9A 9B 9A 9B 99 ?? ?? 9B 99 9B 9A 9B 99 ?? ?? 9B 98 9B 99 9B 9F ?? ?? ?? ?? 9B 9F 9B 99 9B 9F ?? ?? ?? ?? 9B 9E 9B 9A 9B 99 ?? ?? }
        $s156 = { 9C 9D 9C 9D 9C 9E ?? ?? 9C 9E 9C 9D 9C 9E ?? ?? 9C 9F 9C 9E 9C 98 ?? ?? ?? ?? 9C 98 9C 9E 9C 98 ?? ?? ?? ?? 9C 99 9C 9D 9C 9E ?? ?? }
        $s157 = { 9D 9C 9D 9C 9D 9F ?? ?? 9D 9F 9D 9C 9D 9F ?? ?? 9D 9E 9D 9F 9D 99 ?? ?? ?? ?? 9D 99 9D 9F 9D 99 ?? ?? ?? ?? 9D 98 9D 9C 9D 9F ?? ?? }
        $s158 = { 9E 9F 9E 9F 9E 9C ?? ?? 9E 9C 9E 9F 9E 9C ?? ?? 9E 9D 9E 9C 9E 9A ?? ?? ?? ?? 9E 9A 9E 9C 9E 9A ?? ?? ?? ?? 9E 9B 9E 9F 9E 9C ?? ?? }
        $s159 = { 9F 9E 9F 9E 9F 9D ?? ?? 9F 9D 9F 9E 9F 9D ?? ?? 9F 9C 9F 9D 9F 9B ?? ?? ?? ?? 9F 9B 9F 9D 9F 9B ?? ?? ?? ?? 9F 9A 9F 9E 9F 9D ?? ?? }
        $s160 = { A0 A1 A0 A1 A0 A2 ?? ?? A0 A2 A0 A1 A0 A2 ?? ?? A0 A3 A0 A2 A0 A4 ?? ?? ?? ?? A0 A4 A0 A2 A0 A4 ?? ?? ?? ?? A0 A5 A0 A1 A0 A2 ?? ?? }
        $s161 = { A1 A0 A1 A0 A1 A3 ?? ?? A1 A3 A1 A0 A1 A3 ?? ?? A1 A2 A1 A3 A1 A5 ?? ?? ?? ?? A1 A5 A1 A3 A1 A5 ?? ?? ?? ?? A1 A4 A1 A0 A1 A3 ?? ?? }
        $s162 = { A2 A3 A2 A3 A2 A0 ?? ?? A2 A0 A2 A3 A2 A0 ?? ?? A2 A1 A2 A0 A2 A6 ?? ?? ?? ?? A2 A6 A2 A0 A2 A6 ?? ?? ?? ?? A2 A7 A2 A3 A2 A0 ?? ?? }
        $s163 = { A3 A2 A3 A2 A3 A1 ?? ?? A3 A1 A3 A2 A3 A1 ?? ?? A3 A0 A3 A1 A3 A7 ?? ?? ?? ?? A3 A7 A3 A1 A3 A7 ?? ?? ?? ?? A3 A6 A3 A2 A3 A1 ?? ?? }
        $s164 = { A4 A5 A4 A5 A4 A6 ?? ?? A4 A6 A4 A5 A4 A6 ?? ?? A4 A7 A4 A6 A4 A0 ?? ?? ?? ?? A4 A0 A4 A6 A4 A0 ?? ?? ?? ?? A4 A1 A4 A5 A4 A6 ?? ?? }
        $s165 = { A5 A4 A5 A4 A5 A7 ?? ?? A5 A7 A5 A4 A5 A7 ?? ?? A5 A6 A5 A7 A5 A1 ?? ?? ?? ?? A5 A1 A5 A7 A5 A1 ?? ?? ?? ?? A5 A0 A5 A4 A5 A7 ?? ?? }
        $s166 = { A6 A7 A6 A7 A6 A4 ?? ?? A6 A4 A6 A7 A6 A4 ?? ?? A6 A5 A6 A4 A6 A2 ?? ?? ?? ?? A6 A2 A6 A4 A6 A2 ?? ?? ?? ?? A6 A3 A6 A7 A6 A4 ?? ?? }
        $s167 = { A7 A6 A7 A6 A7 A5 ?? ?? A7 A5 A7 A6 A7 A5 ?? ?? A7 A4 A7 A5 A7 A3 ?? ?? ?? ?? A7 A3 A7 A5 A7 A3 ?? ?? ?? ?? A7 A2 A7 A6 A7 A5 ?? ?? }
        $s168 = { A8 A9 A8 A9 A8 AA ?? ?? A8 AA A8 A9 A8 AA ?? ?? A8 AB A8 AA A8 AC ?? ?? ?? ?? A8 AC A8 AA A8 AC ?? ?? ?? ?? A8 AD A8 A9 A8 AA ?? ?? }
        $s169 = { A9 A8 A9 A8 A9 AB ?? ?? A9 AB A9 A8 A9 AB ?? ?? A9 AA A9 AB A9 AD ?? ?? ?? ?? A9 AD A9 AB A9 AD ?? ?? ?? ?? A9 AC A9 A8 A9 AB ?? ?? }
        $s170 = { AA AB AA AB AA A8 ?? ?? AA A8 AA AB AA A8 ?? ?? AA A9 AA A8 AA AE ?? ?? ?? ?? AA AE AA A8 AA AE ?? ?? ?? ?? AA AF AA AB AA A8 ?? ?? }
        $s171 = { AB AA AB AA AB A9 ?? ?? AB A9 AB AA AB A9 ?? ?? AB A8 AB A9 AB AF ?? ?? ?? ?? AB AF AB A9 AB AF ?? ?? ?? ?? AB AE AB AA AB A9 ?? ?? }
        $s172 = { AC AD AC AD AC AE ?? ?? AC AE AC AD AC AE ?? ?? AC AF AC AE AC A8 ?? ?? ?? ?? AC A8 AC AE AC A8 ?? ?? ?? ?? AC A9 AC AD AC AE ?? ?? }
        $s173 = { AD AC AD AC AD AF ?? ?? AD AF AD AC AD AF ?? ?? AD AE AD AF AD A9 ?? ?? ?? ?? AD A9 AD AF AD A9 ?? ?? ?? ?? AD A8 AD AC AD AF ?? ?? }
        $s174 = { AE AF AE AF AE AC ?? ?? AE AC AE AF AE AC ?? ?? AE AD AE AC AE AA ?? ?? ?? ?? AE AA AE AC AE AA ?? ?? ?? ?? AE AB AE AF AE AC ?? ?? }
        $s175 = { AF AE AF AE AF AD ?? ?? AF AD AF AE AF AD ?? ?? AF AC AF AD AF AB ?? ?? ?? ?? AF AB AF AD AF AB ?? ?? ?? ?? AF AA AF AE AF AD ?? ?? }
        $s176 = { B0 B1 B0 B1 B0 B2 ?? ?? B0 B2 B0 B1 B0 B2 ?? ?? B0 B3 B0 B2 B0 B4 ?? ?? ?? ?? B0 B4 B0 B2 B0 B4 ?? ?? ?? ?? B0 B5 B0 B1 B0 B2 ?? ?? }
        $s177 = { B1 B0 B1 B0 B1 B3 ?? ?? B1 B3 B1 B0 B1 B3 ?? ?? B1 B2 B1 B3 B1 B5 ?? ?? ?? ?? B1 B5 B1 B3 B1 B5 ?? ?? ?? ?? B1 B4 B1 B0 B1 B3 ?? ?? }
        $s178 = { B2 B3 B2 B3 B2 B0 ?? ?? B2 B0 B2 B3 B2 B0 ?? ?? B2 B1 B2 B0 B2 B6 ?? ?? ?? ?? B2 B6 B2 B0 B2 B6 ?? ?? ?? ?? B2 B7 B2 B3 B2 B0 ?? ?? }
        $s179 = { B3 B2 B3 B2 B3 B1 ?? ?? B3 B1 B3 B2 B3 B1 ?? ?? B3 B0 B3 B1 B3 B7 ?? ?? ?? ?? B3 B7 B3 B1 B3 B7 ?? ?? ?? ?? B3 B6 B3 B2 B3 B1 ?? ?? }
        $s180 = { B4 B5 B4 B5 B4 B6 ?? ?? B4 B6 B4 B5 B4 B6 ?? ?? B4 B7 B4 B6 B4 B0 ?? ?? ?? ?? B4 B0 B4 B6 B4 B0 ?? ?? ?? ?? B4 B1 B4 B5 B4 B6 ?? ?? }
        $s181 = { B5 B4 B5 B4 B5 B7 ?? ?? B5 B7 B5 B4 B5 B7 ?? ?? B5 B6 B5 B7 B5 B1 ?? ?? ?? ?? B5 B1 B5 B7 B5 B1 ?? ?? ?? ?? B5 B0 B5 B4 B5 B7 ?? ?? }
        $s182 = { B6 B7 B6 B7 B6 B4 ?? ?? B6 B4 B6 B7 B6 B4 ?? ?? B6 B5 B6 B4 B6 B2 ?? ?? ?? ?? B6 B2 B6 B4 B6 B2 ?? ?? ?? ?? B6 B3 B6 B7 B6 B4 ?? ?? }
        $s183 = { B7 B6 B7 B6 B7 B5 ?? ?? B7 B5 B7 B6 B7 B5 ?? ?? B7 B4 B7 B5 B7 B3 ?? ?? ?? ?? B7 B3 B7 B5 B7 B3 ?? ?? ?? ?? B7 B2 B7 B6 B7 B5 ?? ?? }
        $s184 = { B8 B9 B8 B9 B8 BA ?? ?? B8 BA B8 B9 B8 BA ?? ?? B8 BB B8 BA B8 BC ?? ?? ?? ?? B8 BC B8 BA B8 BC ?? ?? ?? ?? B8 BD B8 B9 B8 BA ?? ?? }
        $s185 = { B9 B8 B9 B8 B9 BB ?? ?? B9 BB B9 B8 B9 BB ?? ?? B9 BA B9 BB B9 BD ?? ?? ?? ?? B9 BD B9 BB B9 BD ?? ?? ?? ?? B9 BC B9 B8 B9 BB ?? ?? }
        $s186 = { BA BB BA BB BA B8 ?? ?? BA B8 BA BB BA B8 ?? ?? BA B9 BA B8 BA BE ?? ?? ?? ?? BA BE BA B8 BA BE ?? ?? ?? ?? BA BF BA BB BA B8 ?? ?? }
        $s187 = { BB BA BB BA BB B9 ?? ?? BB B9 BB BA BB B9 ?? ?? BB B8 BB B9 BB BF ?? ?? ?? ?? BB BF BB B9 BB BF ?? ?? ?? ?? BB BE BB BA BB B9 ?? ?? }
        $s188 = { BC BD BC BD BC BE ?? ?? BC BE BC BD BC BE ?? ?? BC BF BC BE BC B8 ?? ?? ?? ?? BC B8 BC BE BC B8 ?? ?? ?? ?? BC B9 BC BD BC BE ?? ?? }
        $s189 = { BD BC BD BC BD BF ?? ?? BD BF BD BC BD BF ?? ?? BD BE BD BF BD B9 ?? ?? ?? ?? BD B9 BD BF BD B9 ?? ?? ?? ?? BD B8 BD BC BD BF ?? ?? }
        $s190 = { BE BF BE BF BE BC ?? ?? BE BC BE BF BE BC ?? ?? BE BD BE BC BE BA ?? ?? ?? ?? BE BA BE BC BE BA ?? ?? ?? ?? BE BB BE BF BE BC ?? ?? }
        $s191 = { BF BE BF BE BF BD ?? ?? BF BD BF BE BF BD ?? ?? BF BC BF BD BF BB ?? ?? ?? ?? BF BB BF BD BF BB ?? ?? ?? ?? BF BA BF BE BF BD ?? ?? }
        $s192 = { C0 C1 C0 C1 C0 C2 ?? ?? C0 C2 C0 C1 C0 C2 ?? ?? C0 C3 C0 C2 C0 C4 ?? ?? ?? ?? C0 C4 C0 C2 C0 C4 ?? ?? ?? ?? C0 C5 C0 C1 C0 C2 ?? ?? }
        $s193 = { C1 C0 C1 C0 C1 C3 ?? ?? C1 C3 C1 C0 C1 C3 ?? ?? C1 C2 C1 C3 C1 C5 ?? ?? ?? ?? C1 C5 C1 C3 C1 C5 ?? ?? ?? ?? C1 C4 C1 C0 C1 C3 ?? ?? }
        $s194 = { C2 C3 C2 C3 C2 C0 ?? ?? C2 C0 C2 C3 C2 C0 ?? ?? C2 C1 C2 C0 C2 C6 ?? ?? ?? ?? C2 C6 C2 C0 C2 C6 ?? ?? ?? ?? C2 C7 C2 C3 C2 C0 ?? ?? }
        $s195 = { C3 C2 C3 C2 C3 C1 ?? ?? C3 C1 C3 C2 C3 C1 ?? ?? C3 C0 C3 C1 C3 C7 ?? ?? ?? ?? C3 C7 C3 C1 C3 C7 ?? ?? ?? ?? C3 C6 C3 C2 C3 C1 ?? ?? }
        $s196 = { C4 C5 C4 C5 C4 C6 ?? ?? C4 C6 C4 C5 C4 C6 ?? ?? C4 C7 C4 C6 C4 C0 ?? ?? ?? ?? C4 C0 C4 C6 C4 C0 ?? ?? ?? ?? C4 C1 C4 C5 C4 C6 ?? ?? }
        $s197 = { C5 C4 C5 C4 C5 C7 ?? ?? C5 C7 C5 C4 C5 C7 ?? ?? C5 C6 C5 C7 C5 C1 ?? ?? ?? ?? C5 C1 C5 C7 C5 C1 ?? ?? ?? ?? C5 C0 C5 C4 C5 C7 ?? ?? }
        $s198 = { C6 C7 C6 C7 C6 C4 ?? ?? C6 C4 C6 C7 C6 C4 ?? ?? C6 C5 C6 C4 C6 C2 ?? ?? ?? ?? C6 C2 C6 C4 C6 C2 ?? ?? ?? ?? C6 C3 C6 C7 C6 C4 ?? ?? }
        $s199 = { C7 C6 C7 C6 C7 C5 ?? ?? C7 C5 C7 C6 C7 C5 ?? ?? C7 C4 C7 C5 C7 C3 ?? ?? ?? ?? C7 C3 C7 C5 C7 C3 ?? ?? ?? ?? C7 C2 C7 C6 C7 C5 ?? ?? }
        $s200 = { C8 C9 C8 C9 C8 CA ?? ?? C8 CA C8 C9 C8 CA ?? ?? C8 CB C8 CA C8 CC ?? ?? ?? ?? C8 CC C8 CA C8 CC ?? ?? ?? ?? C8 CD C8 C9 C8 CA ?? ?? }
        $s201 = { C9 C8 C9 C8 C9 CB ?? ?? C9 CB C9 C8 C9 CB ?? ?? C9 CA C9 CB C9 CD ?? ?? ?? ?? C9 CD C9 CB C9 CD ?? ?? ?? ?? C9 CC C9 C8 C9 CB ?? ?? }
        $s202 = { CA CB CA CB CA C8 ?? ?? CA C8 CA CB CA C8 ?? ?? CA C9 CA C8 CA CE ?? ?? ?? ?? CA CE CA C8 CA CE ?? ?? ?? ?? CA CF CA CB CA C8 ?? ?? }
        $s203 = { CB CA CB CA CB C9 ?? ?? CB C9 CB CA CB C9 ?? ?? CB C8 CB C9 CB CF ?? ?? ?? ?? CB CF CB C9 CB CF ?? ?? ?? ?? CB CE CB CA CB C9 ?? ?? }
        $s204 = { CC CD CC CD CC CE ?? ?? CC CE CC CD CC CE ?? ?? CC CF CC CE CC C8 ?? ?? ?? ?? CC C8 CC CE CC C8 ?? ?? ?? ?? CC C9 CC CD CC CE ?? ?? }
        $s205 = { CD CC CD CC CD CF ?? ?? CD CF CD CC CD CF ?? ?? CD CE CD CF CD C9 ?? ?? ?? ?? CD C9 CD CF CD C9 ?? ?? ?? ?? CD C8 CD CC CD CF ?? ?? }
        $s206 = { CE CF CE CF CE CC ?? ?? CE CC CE CF CE CC ?? ?? CE CD CE CC CE CA ?? ?? ?? ?? CE CA CE CC CE CA ?? ?? ?? ?? CE CB CE CF CE CC ?? ?? }
        $s207 = { CF CE CF CE CF CD ?? ?? CF CD CF CE CF CD ?? ?? CF CC CF CD CF CB ?? ?? ?? ?? CF CB CF CD CF CB ?? ?? ?? ?? CF CA CF CE CF CD ?? ?? }
        $s208 = { D0 D1 D0 D1 D0 D2 ?? ?? D0 D2 D0 D1 D0 D2 ?? ?? D0 D3 D0 D2 D0 D4 ?? ?? ?? ?? D0 D4 D0 D2 D0 D4 ?? ?? ?? ?? D0 D5 D0 D1 D0 D2 ?? ?? }
        $s209 = { D1 D0 D1 D0 D1 D3 ?? ?? D1 D3 D1 D0 D1 D3 ?? ?? D1 D2 D1 D3 D1 D5 ?? ?? ?? ?? D1 D5 D1 D3 D1 D5 ?? ?? ?? ?? D1 D4 D1 D0 D1 D3 ?? ?? }
        $s210 = { D2 D3 D2 D3 D2 D0 ?? ?? D2 D0 D2 D3 D2 D0 ?? ?? D2 D1 D2 D0 D2 D6 ?? ?? ?? ?? D2 D6 D2 D0 D2 D6 ?? ?? ?? ?? D2 D7 D2 D3 D2 D0 ?? ?? }
        $s211 = { D3 D2 D3 D2 D3 D1 ?? ?? D3 D1 D3 D2 D3 D1 ?? ?? D3 D0 D3 D1 D3 D7 ?? ?? ?? ?? D3 D7 D3 D1 D3 D7 ?? ?? ?? ?? D3 D6 D3 D2 D3 D1 ?? ?? }
        $s212 = { D4 D5 D4 D5 D4 D6 ?? ?? D4 D6 D4 D5 D4 D6 ?? ?? D4 D7 D4 D6 D4 D0 ?? ?? ?? ?? D4 D0 D4 D6 D4 D0 ?? ?? ?? ?? D4 D1 D4 D5 D4 D6 ?? ?? }
        $s213 = { D5 D4 D5 D4 D5 D7 ?? ?? D5 D7 D5 D4 D5 D7 ?? ?? D5 D6 D5 D7 D5 D1 ?? ?? ?? ?? D5 D1 D5 D7 D5 D1 ?? ?? ?? ?? D5 D0 D5 D4 D5 D7 ?? ?? }
        $s214 = { D6 D7 D6 D7 D6 D4 ?? ?? D6 D4 D6 D7 D6 D4 ?? ?? D6 D5 D6 D4 D6 D2 ?? ?? ?? ?? D6 D2 D6 D4 D6 D2 ?? ?? ?? ?? D6 D3 D6 D7 D6 D4 ?? ?? }
        $s215 = { D7 D6 D7 D6 D7 D5 ?? ?? D7 D5 D7 D6 D7 D5 ?? ?? D7 D4 D7 D5 D7 D3 ?? ?? ?? ?? D7 D3 D7 D5 D7 D3 ?? ?? ?? ?? D7 D2 D7 D6 D7 D5 ?? ?? }
        $s216 = { D8 D9 D8 D9 D8 DA ?? ?? D8 DA D8 D9 D8 DA ?? ?? D8 DB D8 DA D8 DC ?? ?? ?? ?? D8 DC D8 DA D8 DC ?? ?? ?? ?? D8 DD D8 D9 D8 DA ?? ?? }
        $s217 = { D9 D8 D9 D8 D9 DB ?? ?? D9 DB D9 D8 D9 DB ?? ?? D9 DA D9 DB D9 DD ?? ?? ?? ?? D9 DD D9 DB D9 DD ?? ?? ?? ?? D9 DC D9 D8 D9 DB ?? ?? }
        $s218 = { DA DB DA DB DA D8 ?? ?? DA D8 DA DB DA D8 ?? ?? DA D9 DA D8 DA DE ?? ?? ?? ?? DA DE DA D8 DA DE ?? ?? ?? ?? DA DF DA DB DA D8 ?? ?? }
        $s219 = { DB DA DB DA DB D9 ?? ?? DB D9 DB DA DB D9 ?? ?? DB D8 DB D9 DB DF ?? ?? ?? ?? DB DF DB D9 DB DF ?? ?? ?? ?? DB DE DB DA DB D9 ?? ?? }
        $s220 = { DC DD DC DD DC DE ?? ?? DC DE DC DD DC DE ?? ?? DC DF DC DE DC D8 ?? ?? ?? ?? DC D8 DC DE DC D8 ?? ?? ?? ?? DC D9 DC DD DC DE ?? ?? }
        $s221 = { DD DC DD DC DD DF ?? ?? DD DF DD DC DD DF ?? ?? DD DE DD DF DD D9 ?? ?? ?? ?? DD D9 DD DF DD D9 ?? ?? ?? ?? DD D8 DD DC DD DF ?? ?? }
        $s222 = { DE DF DE DF DE DC ?? ?? DE DC DE DF DE DC ?? ?? DE DD DE DC DE DA ?? ?? ?? ?? DE DA DE DC DE DA ?? ?? ?? ?? DE DB DE DF DE DC ?? ?? }
        $s223 = { DF DE DF DE DF DD ?? ?? DF DD DF DE DF DD ?? ?? DF DC DF DD DF DB ?? ?? ?? ?? DF DB DF DD DF DB ?? ?? ?? ?? DF DA DF DE DF DD ?? ?? }
        $s224 = { E0 E1 E0 E1 E0 E2 ?? ?? E0 E2 E0 E1 E0 E2 ?? ?? E0 E3 E0 E2 E0 E4 ?? ?? ?? ?? E0 E4 E0 E2 E0 E4 ?? ?? ?? ?? E0 E5 E0 E1 E0 E2 ?? ?? }
        $s225 = { E1 E0 E1 E0 E1 E3 ?? ?? E1 E3 E1 E0 E1 E3 ?? ?? E1 E2 E1 E3 E1 E5 ?? ?? ?? ?? E1 E5 E1 E3 E1 E5 ?? ?? ?? ?? E1 E4 E1 E0 E1 E3 ?? ?? }
        $s226 = { E2 E3 E2 E3 E2 E0 ?? ?? E2 E0 E2 E3 E2 E0 ?? ?? E2 E1 E2 E0 E2 E6 ?? ?? ?? ?? E2 E6 E2 E0 E2 E6 ?? ?? ?? ?? E2 E7 E2 E3 E2 E0 ?? ?? }
        $s227 = { E3 E2 E3 E2 E3 E1 ?? ?? E3 E1 E3 E2 E3 E1 ?? ?? E3 E0 E3 E1 E3 E7 ?? ?? ?? ?? E3 E7 E3 E1 E3 E7 ?? ?? ?? ?? E3 E6 E3 E2 E3 E1 ?? ?? }
        $s228 = { E4 E5 E4 E5 E4 E6 ?? ?? E4 E6 E4 E5 E4 E6 ?? ?? E4 E7 E4 E6 E4 E0 ?? ?? ?? ?? E4 E0 E4 E6 E4 E0 ?? ?? ?? ?? E4 E1 E4 E5 E4 E6 ?? ?? }
        $s229 = { E5 E4 E5 E4 E5 E7 ?? ?? E5 E7 E5 E4 E5 E7 ?? ?? E5 E6 E5 E7 E5 E1 ?? ?? ?? ?? E5 E1 E5 E7 E5 E1 ?? ?? ?? ?? E5 E0 E5 E4 E5 E7 ?? ?? }
        $s230 = { E6 E7 E6 E7 E6 E4 ?? ?? E6 E4 E6 E7 E6 E4 ?? ?? E6 E5 E6 E4 E6 E2 ?? ?? ?? ?? E6 E2 E6 E4 E6 E2 ?? ?? ?? ?? E6 E3 E6 E7 E6 E4 ?? ?? }
        $s231 = { E7 E6 E7 E6 E7 E5 ?? ?? E7 E5 E7 E6 E7 E5 ?? ?? E7 E4 E7 E5 E7 E3 ?? ?? ?? ?? E7 E3 E7 E5 E7 E3 ?? ?? ?? ?? E7 E2 E7 E6 E7 E5 ?? ?? }
        $s232 = { E8 E9 E8 E9 E8 EA ?? ?? E8 EA E8 E9 E8 EA ?? ?? E8 EB E8 EA E8 EC ?? ?? ?? ?? E8 EC E8 EA E8 EC ?? ?? ?? ?? E8 ED E8 E9 E8 EA ?? ?? }
        $s233 = { E9 E8 E9 E8 E9 EB ?? ?? E9 EB E9 E8 E9 EB ?? ?? E9 EA E9 EB E9 ED ?? ?? ?? ?? E9 ED E9 EB E9 ED ?? ?? ?? ?? E9 EC E9 E8 E9 EB ?? ?? }
        $s234 = { EA EB EA EB EA E8 ?? ?? EA E8 EA EB EA E8 ?? ?? EA E9 EA E8 EA EE ?? ?? ?? ?? EA EE EA E8 EA EE ?? ?? ?? ?? EA EF EA EB EA E8 ?? ?? }
        $s235 = { EB EA EB EA EB E9 ?? ?? EB E9 EB EA EB E9 ?? ?? EB E8 EB E9 EB EF ?? ?? ?? ?? EB EF EB E9 EB EF ?? ?? ?? ?? EB EE EB EA EB E9 ?? ?? }
        $s236 = { EC ED EC ED EC EE ?? ?? EC EE EC ED EC EE ?? ?? EC EF EC EE EC E8 ?? ?? ?? ?? EC E8 EC EE EC E8 ?? ?? ?? ?? EC E9 EC ED EC EE ?? ?? }
        $s237 = { ED EC ED EC ED EF ?? ?? ED EF ED EC ED EF ?? ?? ED EE ED EF ED E9 ?? ?? ?? ?? ED E9 ED EF ED E9 ?? ?? ?? ?? ED E8 ED EC ED EF ?? ?? }
        $s238 = { EE EF EE EF EE EC ?? ?? EE EC EE EF EE EC ?? ?? EE ED EE EC EE EA ?? ?? ?? ?? EE EA EE EC EE EA ?? ?? ?? ?? EE EB EE EF EE EC ?? ?? }
        $s239 = { EF EE EF EE EF ED ?? ?? EF ED EF EE EF ED ?? ?? EF EC EF ED EF EB ?? ?? ?? ?? EF EB EF ED EF EB ?? ?? ?? ?? EF EA EF EE EF ED ?? ?? }
        $s240 = { F0 F1 F0 F1 F0 F2 ?? ?? F0 F2 F0 F1 F0 F2 ?? ?? F0 F3 F0 F2 F0 F4 ?? ?? ?? ?? F0 F4 F0 F2 F0 F4 ?? ?? ?? ?? F0 F5 F0 F1 F0 F2 ?? ?? }
        $s241 = { F1 F0 F1 F0 F1 F3 ?? ?? F1 F3 F1 F0 F1 F3 ?? ?? F1 F2 F1 F3 F1 F5 ?? ?? ?? ?? F1 F5 F1 F3 F1 F5 ?? ?? ?? ?? F1 F4 F1 F0 F1 F3 ?? ?? }
        $s242 = { F2 F3 F2 F3 F2 F0 ?? ?? F2 F0 F2 F3 F2 F0 ?? ?? F2 F1 F2 F0 F2 F6 ?? ?? ?? ?? F2 F6 F2 F0 F2 F6 ?? ?? ?? ?? F2 F7 F2 F3 F2 F0 ?? ?? }
        $s243 = { F3 F2 F3 F2 F3 F1 ?? ?? F3 F1 F3 F2 F3 F1 ?? ?? F3 F0 F3 F1 F3 F7 ?? ?? ?? ?? F3 F7 F3 F1 F3 F7 ?? ?? ?? ?? F3 F6 F3 F2 F3 F1 ?? ?? }
        $s244 = { F4 F5 F4 F5 F4 F6 ?? ?? F4 F6 F4 F5 F4 F6 ?? ?? F4 F7 F4 F6 F4 F0 ?? ?? ?? ?? F4 F0 F4 F6 F4 F0 ?? ?? ?? ?? F4 F1 F4 F5 F4 F6 ?? ?? }
        $s245 = { F5 F4 F5 F4 F5 F7 ?? ?? F5 F7 F5 F4 F5 F7 ?? ?? F5 F6 F5 F7 F5 F1 ?? ?? ?? ?? F5 F1 F5 F7 F5 F1 ?? ?? ?? ?? F5 F0 F5 F4 F5 F7 ?? ?? }
        $s246 = { F6 F7 F6 F7 F6 F4 ?? ?? F6 F4 F6 F7 F6 F4 ?? ?? F6 F5 F6 F4 F6 F2 ?? ?? ?? ?? F6 F2 F6 F4 F6 F2 ?? ?? ?? ?? F6 F3 F6 F7 F6 F4 ?? ?? }
        $s247 = { F7 F6 F7 F6 F7 F5 ?? ?? F7 F5 F7 F6 F7 F5 ?? ?? F7 F4 F7 F5 F7 F3 ?? ?? ?? ?? F7 F3 F7 F5 F7 F3 ?? ?? ?? ?? F7 F2 F7 F6 F7 F5 ?? ?? }
        $s248 = { F8 F9 F8 F9 F8 FA ?? ?? F8 FA F8 F9 F8 FA ?? ?? F8 FB F8 FA F8 FC ?? ?? ?? ?? F8 FC F8 FA F8 FC ?? ?? ?? ?? F8 FD F8 F9 F8 FA ?? ?? }
        $s249 = { F9 F8 F9 F8 F9 FB ?? ?? F9 FB F9 F8 F9 FB ?? ?? F9 FA F9 FB F9 FD ?? ?? ?? ?? F9 FD F9 FB F9 FD ?? ?? ?? ?? F9 FC F9 F8 F9 FB ?? ?? }
        $s250 = { FA FB FA FB FA F8 ?? ?? FA F8 FA FB FA F8 ?? ?? FA F9 FA F8 FA FE ?? ?? ?? ?? FA FE FA F8 FA FE ?? ?? ?? ?? FA FF FA FB FA F8 ?? ?? }
        $s251 = { FB FA FB FA FB F9 ?? ?? FB F9 FB FA FB F9 ?? ?? FB F8 FB F9 FB FF ?? ?? ?? ?? FB FF FB F9 FB FF ?? ?? ?? ?? FB FE FB FA FB F9 ?? ?? }
        $s252 = { FC FD FC FD FC FE ?? ?? FC FE FC FD FC FE ?? ?? FC FF FC FE FC F8 ?? ?? ?? ?? FC F8 FC FE FC F8 ?? ?? ?? ?? FC F9 FC FD FC FE ?? ?? }
        $s253 = { FD FC FD FC FD FF ?? ?? FD FF FD FC FD FF ?? ?? FD FE FD FF FD F9 ?? ?? ?? ?? FD F9 FD FF FD F9 ?? ?? ?? ?? FD F8 FD FC FD FF ?? ?? }
        $s254 = { FE FF FE FF FE FC ?? ?? FE FC FE FF FE FC ?? ?? FE FD FE FC FE FA ?? ?? ?? ?? FE FA FE FC FE FA ?? ?? ?? ?? FE FB FE FF FE FC ?? ?? }
        $s255 = { FF FE FF FE FF FD ?? ?? FF FD FF FE FF FD ?? ?? FF FC FF FD FF FB ?? ?? ?? ?? FF FB FF FD FF FB ?? ?? ?? ?? FF FA FF FE FF FD ?? ?? }
        
        $fp1 = "ICSharpCode.Decompiler" wide
    condition:
        any of ($s*) and not 1 of ($fp*)
}

rule CobaltStrike_MZ_Launcher {
    meta:
        description = "Detect the risk of  Malware Cobalt Strike Rule 47"
    strings:
        $mz_launcher = { 4D 5A 41 52 55 48 89 E5 48 81 EC 20 00 00 00 48 8D 1D }
    condition:
        $mz_launcher
}

rule CobaltStrike_Unmodifed_Beacon {
    meta:
        description ="Detect the risk of  Malware Cobalt Strike Rule 48"
    strings:
        $loader_export = "ReflectiveLoader"
        $exportname = "beacon.dll"
    condition:
        all of them
}


rule HKTL_CobaltStrike_Beacon_Strings {
   meta:
      description = "Detect the risk of  Malware Cobalt Strike Rule 49"
   strings:
      $s1 = "%02d/%02d/%02d %02d:%02d:%02d"
      $s2 = "Started service %s on %s"
      $s3 = "%s as %s\\%s: %d"
   condition:
      2 of them
}


rule HKTL_CobaltStrike_Beacon_4_2_Decrypt {
   meta:
      description = "Detect the risk of  Malware Cobalt Strike Rule 50"
   strings:
      $a_x64 = {4C 8B 53 08 45 8B 0A 45 8B 5A 04 4D 8D 52 08 45 85 C9 75 05 45 85 DB 74 33 45 3B CB 73 E6 49 8B F9 4C 8B 03}
      $a_x86 = {8B 46 04 8B 08 8B 50 04 83 C0 08 89 55 08 89 45 0C 85 C9 75 04 85 D2 74 23 3B CA 73 E6 8B 06 8D 3C 08 33 D2}
   condition:
      any of them
}

rule HKTL_Win_CobaltStrike  {
   meta:
      description ="Detect the risk of  Malware Cobalt Strike Rule 51"
   strings:
      $s1 = "%s (admin)" fullword
      $s2 = {48 54 54 50 2F 31 2E 31 20 32 30 30 20 4F 4B 0D 0A 43 6F 6E 74 65 6E 74 2D 54 79 70 65 3A 20 61 70 70 6C 69 63 61 74 69 6F 6E 2F 6F 63 74 65 74 2D 73 74 72 65 61 6D 0D 0A 43 6F 6E 74 65 6E 74 2D 4C 65 6E 67 74 68 3A 20 25 64 0D 0A 0D 0A 00}
      $s3 = "%02d/%02d/%02d %02d:%02d:%02d" fullword
      $s4 = "%s as %s\\%s: %d" fullword
      $s5 = "%s&%s=%s" fullword
      $s6 = "rijndael" fullword
      $s7 = "(null)"
   condition:
      all of them
}